Detection and Response Engineer

This is a fully remote position, open to applicants in United Kingdom.

📋 Description

• Create and manage AI-enhanced, agentic detection workflows on a large scale, ensuring human quality oversight.

• Develop and deploy network signatures and detections based on vast internet-scale scan and probe data.

• Detect services, versions, and vulnerable hosts effectively.

• Construct detections utilizing Canary telemetry to differentiate between genuine exploitation and internet noise.

• Transform exploitation signals into actionable threat intelligence for clients.

• Implement feedback loops into probing and data collection capabilities.

• Assess required data collection, eliminate unnecessary data, and identify coverage gaps.

• Analyze detection quality and adjust false-positive and false-negative rates accordingly.

• Respond promptly to significant vulnerabilities by assessing, building coverage, and deploying detections.

• Work collaboratively with vulnerability researchers and threat hunters to link detection engineering with exploit intelligence.

⛳️ Requirements

• Over 5 years of experience in developing and delivering durable detections from network and host data.

• Demonstrated ability to scale detection development and continuous evaluation processes using AI and agentic workflows with human oversight.

• Proven history of researching, engineering, and validating durable detections across network and host telemetry.

• A methodical approach to managing false positives and false negatives.

• Proficiency in device fingerprinting and protocol analysis.

• Understanding of attacker command-and-control techniques, covert channels, and exploitation artifacts.

• Experience with network traffic analysis.

• Background in host-based analysis and Digital Forensics and Incident Response (DFIR).

• Strong programming or scripting skills.

• Familiarity with CVE, NVD, KEV, or exploit intelligence datasets.

• Proactive mindset towards newly disclosed vulnerabilities.

• Preferred: Experience with Suricata, Snort, Zeek, Nuclei templates, or similar tools.

• Preferred: Published detection research, signatures, or open-source detection content.

• Preferred: Experience with streaming systems or real-time data processing.

• Preferred: Background in high-growth or startup environments.

🏝️ Benefits

• A transparent, collaborative, and supportive workplace culture.

• An environment that fosters a growth mindset.

• An equal employment opportunity employer.

• Reasonable accommodations provided for applicants with physical and mental disabilities.

• Utilization of an AI-powered Talent Matching tool during recruitment.