Detection Engineer - Product Security

Details

Join Product Security to build and improve how threats are detected and responded to across web and mobile applications, APIs, and supporting services. The role involves developing SIEM detections, improving telemetry, strengthening AI-agent-assisted alert triage, and building carefully controlled response automation.

Responsibilities

• Build, test, and tune security detections and anomaly-detection jobs in a SIEM using version control, backtesting, and staged releases.
• Develop detection coverage for account takeover, automated abuse, unusual traffic, enumeration, access-control failures, authentication and session misuse, and suspicious access to sensitive data.
• Identify the application events and fields needed for effective detection.
• Work with application and platform teams to improve event coverage, quality, and attribution.
• Design, build, and improve the AI triage agent, including workflows, tool integrations, context enrichment, and escalation behavior.
• Measure decision quality, reduce noise, and ensure uncertain or high-impact cases reach a human responder.
• Build incident workflows and response playbooks that enrich alerts, route them to the appropriate responders, and provide clear investigation guidance.
• Introduce response automation in stages, with appropriately limited scope, human approvals, audit records, monitoring, and rollback.
• Evaluate detection and response performance, investigate failures, and use responder feedback to improve the system.

Requirements

• Experience building or operating production software or security systems.
• Practical experience with SIEM queries, security analytics, detection development, or alert tuning.
• Knowledge of web, mobile, or API security threats and how to detect them in application and security data.
• Ability to write maintainable code and automation in a language such as Python, Go, or Java.
• Hands-on experience building, integrating, or extending AI agents or LLM-powered applications, including tool integrations, orchestration, evaluation, and safety controls.
• Understanding of logging, event schemas, data quality, and how telemetry gaps affect security detection.
• Experience testing and deploying automation safely, including access control, auditability, failure handling, and rollback.
• Clear communication and the ability to work with security, application, and platform teams.

Helpful Experience

• Behavioral analytics, anomaly detection, or machine-learning systems.
• Agent frameworks, tool-calling workflows, retrieval and context enrichment, and LLM evaluation.
• Security orchestration, incident response, or containment playbooks.
• Web and mobile application security testing or investigation.
• Infrastructure as code and CI/CD practices.

Contract Details

• Independent contractor position.
• Project duration: 1 year, from October 22, 2026, to October 21, 2027.
• Hours: 40 per week.