Detection and Response Engineer

Responsibilities:

• Monitor, triage, and investigate security alerts across customer cloud environments, determining scope, impact, and root cause.
• Develop, tune, and maintain detection rules and correlation logic to improve fidelity and reduce false positives.
• Conduct proactive, hypothesis-driven threat hunts to uncover previously unknown threats and detection gaps.
• Respond to security incidents, executing containment and eradication steps and recommending recovery actions; escalate high-severity incidents as appropriate.
• Participate in the team's on-call/rotational schedule to support 24/7 detection and response coverage.
• Write clear, accurate incident reports and customer-facing updates on findings and remediation guidance.
• Contribute to and maintain playbooks, runbooks, and standard operating procedures for the DRE function.
• Build scripts and automations (Python, Bash, SQL) to speed up investigations and response workflows.
• Map detections and investigations to the MITRE ATT& CK framework to track coverage.
• Share field-identified detection gaps, tooling needs, and platform feedback with Product and Engineering.
• Collaborate with Software Development, SRE, and Customer Success teams on customer onboarding and platform integrations.
• Mentor peers and share knowledge through investigation reviews, write-ups, and internal sessions.

Requirements:

• 3-6+ years of experience in security operations, detection engineering, threat hunting, or incident response.
• Hands-on experience working in a SOC or MDR environment, including alert triage and on-call/rotational coverage.
• Proven ability to write, test, and tune detection logic and correlation rules.
• Solid incident response experience, including hands-on containment, eradication, and recovery.
• Working knowledge of security in at least one major cloud provider (AWS, Azure, or GCP).
• Proficiency in scripting (Python, Bash) and querying data with SQL or similar query languages.
• Strong analytical and problem-solving skills, with attention to detail under pressure.
• Excellent written and verbal communication skills, including the ability to explain technical findings to customers.
• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

Preferred Skills:

• Deep experience across multiple cloud providers (AWS, Azure, GCP), including identity and logging services (e. g., CloudTrail, Entra ID, Cloud Audit Logs).
• Familiarity with securing code and identity repositories and SaaS platforms (e. g., GitHub, Atlassian, Okta).
• Strong working knowledge of the MITRE ATT& CK framework and applying it to detection development.
• Experience with SIEM, EDR, SOAR, or detection-as-code tooling.
• Experience working with globally distributed teams across time zones.
• Experience at a startup or high-growth security company.
• Relevant certifications (e. g., GCIH, GCFA, GCIA, AWS/Azure/GCP security certifications, OSCP) are a plus.