Detection and Response Engineer

Security Incident Response

• Own escalated security incidents end-to-end, including scoping, evidence collection, threat analysis, containment, and remediation
• Analyze and reverse engineer malware to understand its behavior, extract Indicators of Compromise (IOCs), identify Tactics, Techniques, and Procedures (TTPs), and determine appropriate detection and response
• Conduct threat hunting using existing detection content, threat intelligence, and independent hypothesis-driven analysis
• Review and provide feedback on reported security incidents

Detection Engineering

• Write, test, and deploy detection rules (YARA-L or equivalent) through the team's CI/CD Detection-as-Code pipeline
• Tune existing detections to reduce false positives, using incident and hunting findings as the primary signal for what needs fixing
• Identify detection gaps surfaced during investigations and translate them into new rule proposals
• Build and maintain SOAR playbooks and security automation, including AI-driven and agentic workflows, to automate alert triage, enrich investigations, and speed up incident response.
• Participate in tabletop, purple-team, and threat-intel-driven simulation exercises, including scenario execution and converting findings into new detections
• Translate relevant threat intelligence into new detection opportunities or hunting hypotheses

Collaboration & Documentation

• Work cross-functionally with cloud security, infrastructure, and development teams to close systemic gaps identified during investigations
• Maintain accurate records for incidents, detection changes, and threat intelligence, and keep the playbook library current
• Document new detection logic and rule changes to a standard that supports peer review and audit

Compliance & Continuous Improvement

• Ensure IR and detection engineering practices align with PCI-DSS, ISO 27001, and NIST CSF 2.0
• Stay current with cybersecurity trends and threat landscape shifts, and proactively implement IR or detection process improvements

Log Integration, Visibility, & Threat Modeling

• Drive log source onboarding and ingestion health across enterprise applications and cloud environments; identify critical visibility gaps; and coordinate remediation with relevant teams.
• Lead threat modeling exercises for critical infrastructure and translate findings into high-fidelity detection rules and proactive threat hunting hypotheses
• Implement and maintain automated event enrichment pipelines to enhance context for security investigations and improve analyst efficiency.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field (or equivalent hands-on experience)
• 2 - 4 years of experience in incident response, SOC operations, or detection engineering
• Demonstrated experience writing or tuning detection rules in a SIEM (Google SecOps, or similar), using a rule language such as YARA-L, CQL, KQL, or Sigma
• Solid experience with SIEM and EDR platforms, log analysis, and end-to-end incident triage/investigation
• Working knowledge of MITRE ATT&CK and how it maps to detection coverage
• Comfortable with Python, JavaScript, or a similar scripting language for automation and detection support work
• Strong written communication skills for incident reports and detection documentation

Preferred Skills & Certifications

• Experience with SOAR platforms or building automation for triage/enrichment
• Exposure to multi-cloud environments (GCP, AWS) and fintech/financial-sector threats
• Foundational digital forensics or malware analysis experience
• GCIH, CySA+, or equivalent IR/detection engineering certifications