Detection Engineer, Protective Services

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop technical capabilities to identify and analyze threats to safeguarded individuals.

• Create detections, enrichment, and automation across identity, endpoint, cloud, marketplace, support, physical access, and open-source signals.

• Convert threat intelligence, incidents, investigative requirements, and observed behaviors into actionable detections.

• Test, implement, optimize, and maintain detections and associated pipelines at scale.

• Correlate enterprise telemetry, marketplace activities, physical security events, OSINT, support interactions, and other relevant data.

• Utilize rules, statistical methods, machine learning, and LLM-based techniques to enhance detection quality and investigative context.

• Investigate detections by querying and correlating data, validating hypotheses, and evaluating confidence, scope, and impact.

• Continuously enhance detection logic, tools, and workflows based on investigation results and false-positive assessments.

• Contribute to technical reviews, testing, documentation, standards, and automation efforts.

• Engage in on-call duties and support significant investigations.

• Collaborate with Protective Services, engineering, investigative, and response teams.

• Report directly to the Engineering Manager, Protective Services.

⛳️ Requirements

• Over 3 years of experience in detection engineering, threat hunting, incident response, security operations engineering, technical threat intelligence, or software engineering applied to security challenges.

• Proven experience in contributing to production detection pipelines utilizing source control, testing, review, deployment, and monitoring practices.

• Proficiency in SQL or a security query language.

• Capability to write maintainable code in Python, Go, or another relevant programming language.

• Strong analytical abilities to explore unfamiliar datasets, assess data quality, troubleshoot across systems, and formulate testable detection hypotheses.

• Experience in triaging alerts and investigations, correlating signals across various data sources, and communicating evidence-supported conclusions.

• Familiarity with building detections or conducting investigations using security, behavioral, or other relevant telemetry.

• Experience leveraging automation or analytics to enhance detection and investigation workflows.

• Knowledge of MITRE ATT&CK or D3FEND frameworks.

• Excellent collaboration and communication skills.

• Ability to manage sensitive information responsibly.

• Bachelor's degree or equivalent practical experience.

• Familiarity with Snowflake, Cortex, or Google SecOps is preferred.

🏝️ Benefits

• Equity grants.

• 401(k) plan with employer matching.

• 16 weeks of paid parental leave.

• Wellness benefits.

• Commuter benefits match.

• Paid time off.

• Paid sick leave.

• Medical, dental, and vision benefits.

• 11 paid holidays.

• Disability insurance.

• Basic life insurance.

• Family-forming assistance.

• Mental health program.

• Flexible paid time off/vacation for salaried positions.

• 80 hours of paid sick time per year for salaried roles.

• Premium healthcare.

• Wellness expense reimbursement.