← All roles

Senior Detection Engineer (EDR), Autonomous Defense

Horizon3 AI· Engineering
Apply on company site
Remote$195k - $230kFull-timePosted 4w ago

About the role

Senior Detection Engineer on the Autonomous Defense team to define what detection and remediation means, acting as the blue team voice between Product and Engineering to establish the ground truth for detections and tuning.

Responsibilities

  • Partner with Product to turn EDR effectiveness and tuning ambitions into concrete, buildable requirements.
  • Translate blue team workflows and pain into prioritized product outcomes, and push back when a proposed feature or agent behavior would not hold up in a real SOC.
  • Define acceptance criteria for detection, effectiveness, and tuning features, and validate releases against them before customers see them.
  • Serve as the standing domain reference for Engineering and AI research: available for design reviews, technique questions, and vendor behavior questions.
  • Own deep, current knowledge of the major EDR and endpoint platforms at the console, policy, telemetry, and API level.
  • Maintain fluency in how detection logic, prevention policy, exclusions, and tuning actually work in each product, including default vs hardened configurations.
  • Define the vendor-specific policy semantics, so a recommended change means the same thing across platforms.
  • Track platform changes, new detection capabilities, and vendor guidance, and keep our coverage model current as vendors ship.
  • Define what a correct tuning recommendation looks like and grade agent output against that standard.
  • Partner with the Attack team so technique coverage and detection expectations stay grounded in current adversary tradecraft.

Qualifications

  • 6+ years in detection engineering, security operations, incident response, or threat hunting, with meaningful time spent as a practitioner.
  • Hands-on operational experience administering and tuning EDR platforms in production — writing detections, managing policy and exclusions, and investigating real alerts.
  • Deep understanding of what a SOC actually does with EDR output.
  • Fluency in false positive and false negative tradeoffs, alert fatigue, and detection coverage measurement.
  • Strong working knowledge of MITRE ATT&CK and detection coverage frameworks, and a clear view of where they help and where they mislead.
  • Solid understanding of post-compromise attacker behavior and how each surfaces in endpoint and identity telemetry.
  • Demonstrated experience shaping a product or platform as a domain expert, whether in a security vendor, internal tooling team, or a detection engineering function.
  • Ability to influence without authority. You will not manage the engineers or own the roadmap, and you will still be expected to move both.
  • Exceptional technical writing. Requirements, methodology docs, labeling guides, tuning content.
  • Comfort translating between audiences: engineers, AI researchers, product managers, SOC analysts, and executives.
  • Enough scripting ability, ideally Python, to query APIs, inspect telemetry, and prototype an analysis.
  • Comfort with SQL and with reasoning over large volumes of event and telemetry data.

Skills

Required:EDR & blue team expertiseProduct & collaborationTechnical fluency

Benefits

  • Inclusive Team: We value diversity and promote an inclusive culture where everyone can thrive.
  • Growth Opportunities: Be part of a dynamic and growing team with numerous career development opportunities.
  • Innovative Culture: Work in a collaborative environment that encourages creativity and out-of-the-box thinking.
  • Hybrid & Remote Work: We embrace a mix of remote and hybrid work models depending on role and location, including our Chicago office, where some roles require regular in-office presence.
  • Competitive Compensation: We offer competitive salary, equity and benefits. Our benefits include health, vision & dental insurance for you and your family, a flexible vacation policy, and generous parental leave.
Last updated Oct 8, 2026. Interested? Apply on the company site.

About Horizon3 AI

Only Pentesting Platform Proven in Production

Continuously assess, fix, and verify your security posture. Securing enterprises across many attack surfaces.

PentestingSecurity PostureThreat DetectionVulnerabilitiesRisk AssessmentOffensive Security
Company profileWebsite

More open roles at Horizon3 AI