Staff Engineer, Detection and Response

Responsibilities

• Strategy and influence
• Own D&R strategy and turn it into multi-quarter initiatives tied to Security KRs. Report progress and risks to leadership in business terms.
• Work with Engineering, Infrastructure and IT so logging, telemetry and response readiness are planned into their roadmaps early.
• Set D&R standards: detections and response as code, review practices, playbook quality, and AI-assisted workflows.
• Mentor engineers to own detections and lead incidents, and help raise the hiring bar.
• Detection engineering and observability
• Own detection architecture and the multi-quarter coverage plan: log sources, enrichment, correlation, alert routing, and cost at scale.
• Own security observability: telemetry onboarding, signal quality, threat intel inputs and alert tuning.
• Run the detection lifecycle: intake and prioritization, unit tests, replay against historical data, attack simulation, and regular reviews of coverage gaps, latency, false positives and MTTD.
• Stay hands-on: ship MITRE ATT&CK-aligned detections, threat hunts and automations in Panther and Python via Git and CI/CD.

Languages