Detection and Response Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Detection and Response Engineer based in the United States. This full-time remote role focuses on strengthening detection, incident response, security automation, and AI-enabled SOC operations. You will engineer and continuously improve security detection capabilities across endpoint, network, cloud, and identity environments. The role combines hands-on threat detection with incident investigation, forensic support, automation, and security tooling. You will help close visibility gaps, reduce manual analyst effort, and accelerate the path from detection through resolution. A key component of the position involves evaluating and implementing AI and LLM-powered capabilities for security operations. You will collaborate closely with SOC, IT, cloud, network, identity, and engineering teams in a fast-moving security environment. Your work will directly contribute to improving the organization's ability to identify, investigate, contain, and respond to evolving cyber threats. Accountabilities - Design, build, tune, and maintain detection content, including rules, correlation searches, and security use cases across endpoint, network, cloud, and identity data sources. - Perform detection coverage and gap analysis using the MITRE ATT&CK framework, actual telemetry, and the organization's attack surface to prioritize improvements. - Validate detection logic against real-world adversary techniques and threat intelligence while reducing false positives without compromising detection effectiveness. - Maintain and version-control detection rules, associated documentation, coverage information, and known gaps. - Triage, investigate, and contain security incidents and alerts across the environment. - Conduct root-cause analysis and structured post-incident reviews, incorporating lessons learned into detection and response improvements.

- Document incident timelines, indicators of compromise, remediation activities, and investigative findings. - Support forensic investigations involving compromised hosts, user accounts, and applications, and participate in an on-call rotation for critical incidents when required. - Evaluate, pilot, and implement AI- and LLM-powered solutions for alert triage, enrichment, investigation, and analyst workflows. - Build and optimize AI-assisted security workflows that reduce analyst workload and improve mean time to respond. - Identify high-value opportunities for AI and automation while measuring their operational impact and applying appropriate human validation. - Develop security automation and orchestration using SOAR platforms, scripts, APIs, and integrations. - Automate repetitive detection and incident response activities such as evidence collection, enrichment, and ticketing. - Build and maintain incident response playbooks, runbooks, and supporting procedures. - Develop and maintain Python, PowerShell, or similar scripts that integrate security tools and data sources. - Partner with cloud, network, identity, and engineering teams to address telemetry and visibility gaps. - Monitor threat intelligence, adversary tactics, techniques, procedures, and vulnerabilities relevant to payment and financial technology environments. - Communicate security findings, coverage gaps, recommendations, and incident information effectively to technical and non-technical stakeholders. - Maintain procedures and policy documentation supporting detection and response operations. Requirements - Bachelor’s degree in a technical field or equivalent professional experience. - 3–5 years of hands-on information security experience, with demonstrated depth in at least two areas such as detection engineering, incident response, security automation, or SOC operations.