← All roles

Security Engineer - Detection and Response

Spotify· Engineering – Platform
Apply on company site
Hybrid (New York, NY)$132.9k - $189.9kPermanentPosted 3w ago

About the role

Security engineer role within Spotify's Detection and Response organization focused on identifying, investigating, and responding to threats across Spotify's environment. Works in the detection engineering squad to turn threat intelligence into effective detections and investigation workflows, in collaboration with the detection infrastructure squad and other teams.

Responsibilities

  • Identify detection opportunities, define clear telemetry requirements, and partner with the detection infrastructure squad and data owners to make the signals needed for detection and investigation available.
  • Develop, test, tune, and maintain detections across endpoint, identity, cloud, SaaS, email, and other security-relevant environments.
  • Investigate and prioritize alerts, determine their security impact, and participate in incident containment and remediation.
  • Build repeatable investigation workflows and playbooks for alert triage, evidence collection, decision-making, escalation, containment, and response.
  • Improve proactive threat-identification and threat-hunting capabilities using internal telemetry and external threat intelligence.
  • Create cutting-edge AI workflows for Detection and Response that enrich alerts, gather and analyze evidence, guide investigations, and automate repetitive response work while preserving appropriate human judgment and oversight.
  • Measure detection effectiveness, identify coverage gaps, and tune detections to balance security value, fidelity, and analyst workload.
  • Use SIEM, EDR, SOAR, and related security platforms to research threats, develop detections, investigate alerts, and validate security outcomes.
  • Share knowledge, document decisions, and communicate security findings clearly to technical and non-technical audiences.

Qualifications

  • 3+ years of hands-on experience in security operations, incident response, threat detection, detection engineering, or closely related work.
  • Understanding of how analysts triage and investigate alerts and how detection quality affects their decisions and workload.
  • Ability to create and tune detections based on attacker behavior, available telemetry, and an expected investigation path.
  • Experience with security platforms such as SIEM, EDR, SOAR, or comparable monitoring and response technologies.
  • Ability to write code or use an automation platform to analyze security telemetry, enrich alerts, build investigation workflows, and remove repetitive work; Python or similar language valued.
  • Understanding of detection-as-code practices, including GitHub, peer review, CI/CD, testing, and safely managing production detection content.
  • Experience with at least one major cloud platform (Google Cloud, AWS, or Azure).
  • Understanding of common threats affecting SaaS-oriented corporate and production environments.
  • Commitment to clear documentation, inclusive collaboration, and explaining security concepts to varied audiences.
  • Interest in creating and evaluating cutting-edge AI workflows for detection development, alert triage, investigations, and response with appropriate human oversight.

Skills

Required:Security operations, incident response, threat detection, detection engineeringDetection engineeringTelemetry and alertingAutomation / scriptingCloud platformsSIEM/EDR/SOARDetection-as-code

Benefits

  • health insurance
  • six-month paid parental leave
  • 401(k) retirement plan
  • monthly meal allowance
  • 23 paid days off
  • paid flexible holidays
  • paid sick leave
Last updated Oct 21, 2026. Interested? Apply on the company site.

About Spotify

Music for everyone

Spotify is a digital music service that gives you access to millions of songs.

music streamingdigital music service
Company profileWebsite

More open roles at Spotify