Detection Engineer

[https://app.ashbyhq.com/api/images/user-content/2de35798-eaa0-40a0-aa54-2adb1fe38726/b186ebec-4bab-4234-a9c4-cf751ae65bb2/hero-detection-engineer.png] We’re looking for a Detection Engineer to join our Customer Experience, Research, and Training (CERT) team and take ownership of the hard part of detection engineering. You’ll be the technical specialist who takes detection logic out of the lab and proves it in the wild, validating, tuning, and operationalising detections inside real customer environments where the stakes are real. Working closely with the Lead Detection Engineer, you’ll ensure the detections we ship are investigation-ready, operationally effective, and grounded in how adversaries actually behave. If you’re excited by the challenge of turning real attacker behaviour into detections that actually catch them, and enjoy bridging the gap between research and real-world operations, we’d love to hear from you. + WHAT YOU’LL DO - Build, validate, and sharpen detection logic based on live investigative research and emerging threats - Pressure-test detections against real-world telemetry - Partner directly with Product Engineering to push high-confidence detections and investigative insights into Binalyze AIR, so the platform evolves at the speed of the threat landscape - Turn what we learn from attackers this week into detection capability next week + WHAT GOOD LOOKS LIKE By 3 months: Onboarded with CERT, Product, and Engineering; baseline understanding of Binalyze AIR detection coverage, customer telemetry patterns, and the current detection backlog; validated and tuned a first set of detections in for at least one product type; first structured feedback delivered to CERT on detection efficacy. By 6 months: Established subject-matter ownership of at least one attacker-technique area; consistent flow of validated detection improvements landing in Binalyze AIR; recognised technical escalation point during complex customer investigations; trusted partner to Solutions Consulting and Forward Deployed Security Architects (FDSA) on detection-related engagements. By 12 months: Measurable improvement in detection quality and investigative signal across the portfolio; faster validation of detections in real customer environments; reduced friction during investigations involving detection logic; demonstrable influence on detection-related roadmap decisions; positive feedback from Solutions Consulting, FDSA, and Product teams. + ABOUT YOU - Bachelor’s degree in Computer Science, Cybersecurity, or related field; or equivalent professional experience. - Strong background in cybersecurity investigations, detection engineering, threat hunting, or security operations - Hands-on experience developing, validating, and tuning detections in live or production environments - Practical experience with detection and analysis technologies such as YARA, Sigma, SQL, and Python - Familiarity with reverse engineering, malware analysis, or deep artifact analysis to support detection development - Deep understanding of attacker techniques, tradecraft, and investigative workflows across endpoint, network, and cloud environments - Ability to translate technical findings into clear, actionable feedback for Product and Engineering teams Preferred/Desirable: - DFIR, SOC, or threat detection background in enterprise environments - Experience contributing detections to security platforms or products - Familiarity with endpoint, log, or telemetry-based detection systems - Experience working in fast-moving, customer-facing security roles SKILLS & BEHAVIOURS Technical skills: You develop, validate, and tune detection logic using YARA, Sigma, SQL, and Python in real production environments. Detection engineering: You design detections grounded in investigator workflows and attacker tradecraft — not abstract theory — and refine them continuously based on real customer outcomes. Communication: You translate complex technical findings into clear, actionable feed