Detection Engineer II

Responsibilities

• Develop, tune, document, and maintain detection logic across multiple log sources including endpoint, cloud, container, and SaaS products.
• Assist in cyber forensic investigations across a variety of log sources.
• Optimize log ingestion pipelines and telemetry collection to ensure high-quality, actionable security data while managing volume and cost.
• Design and build SOAR playbooks and automation workflows to streamline detection triage, enrichment, and response actions.
• Mentor/knowledge share with other detection engineers on threat hunting methodologies, detection logic development, and investigation techniques.

Requirements

• 2+ years of experience in a detection engineering, incident response, or offensive security role.
• Experience with 1 or more public cloud platforms (AWS, Azure, GCP).
• Deep understanding of attacker TTPs across modern zero trust environments, including identity compromise, token theft, and abuse of trust boundaries.
• Proficient understanding of macOS internals and telemetry available to identify macOS specific threats.
• Experience implementing detection-as-code workflows including version control, peer review processes, automated testing, and CI/CD deployment pipelines.
• Basic proficiency with Python, Golang, or other programming/scripting languages.
• Relevant certifications such as GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar.

Nice-to-Haves

• Background in offensive security or red teaming.
• Knowledge of machine learning for threat detection.