Detection Engineer/Endpoint Security Engineer

About the role

The driver and agents already emit a broad telemetry surface: process creation and termination, process access, image load, driver load, thread creation, registry key and value operations, network connections, DNS queries and file activity. Telemetry on its own catches nothing. This role exists to turn that telemetry into detections that fire on real adversary behaviour, prove they fire, and keep them quiet enough that an analyst trusts them.

What you'll do

• Author, tune and maintain detection rules for endpoint threats, and keep coverage mapped to MITRE ATT&CK
• Translate techniques into concrete detection logic against the events our driver and agent emit
• Retire and replace detections that no longer earn their keep
• Build benign emulations that reproduce the telemetry signature of a technique without shipping working offensive capability or live C2 into an internal build
• Compare what a detection needs against what the agent and driver emit today, and write up concrete, implementable telemetry requests for the driver and agent teams

What you need

• 2–4 yrs of experience
• EDR
• Python
• Test cases
• Lab testing
• JIRA
• PowerShell
• Any graduate

Good to have

• Git