Detection and Response Engineer

About the role

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Detection and Response Engineer based in the United States. This full-time remote role focuses on strengthening detection, incident response, security automation, and AI-enabled SOC operations. You will engineer and continuously improve security detection capabilities across endpoint, network, cloud, and identity environments. The role combines hands-on threat detection with incident investigation, forensic support, automation, and security tooling. You will help close visibility gaps, reduce manual analyst effort, and accelerate the path from detection through resolution. A key component of the position involves evaluating and implementing AI and LLM-powered capabilities for security operations. You will collaborate closely with SOC, IT, cloud, network, identity, and engineering teams in a fast-moving security environment. Your work will directly contribute to improving the organization's ability to identify, investigate, contain, and respond to evolving cyber threats.

Responsibilities

• Design, build, tune, and maintain detection content, including rules, correlation searches, and security use cases across endpoint, network, cloud, and identity data sources.
• Perform detection coverage and gap analysis using the MITRE ATT&CK framework, actual telemetry, and the organization's attack surface to prioritize improvements.
• Validate detection logic against real-world adversary techniques and threat intelligence while reducing false positives without compromising detection effectiveness.
• Maintain and version-control detection rules, associated documentation, coverage information, and known gaps.
• Triage, investigate, and contain security incidents and alerts across the environment.
• Conduct root-cause analysis and structured post-incident reviews, incorporating lessons learned into detection and response improvements.
• Document incident timelines, indicators of compromise, remediation activities, and investigative findings.
• Support forensic investigations involving compromised hosts, user accounts, and applications, and participate in an on-call rotation for critical incidents when required.
• Evaluate, pilot, and implement AI- and LLM-powered solutions for alert triage, enrichment, investigation, and analyst workflows.
• Build and optimize AI-assisted security workflows that reduce analyst workload and improve mean time to respond.
• Identify high-value opportunities for AI and automation while measuring their operational impact and applying appropriate human validation.
• Develop security automation and orchestration using SOAR platforms, scripts, APIs, and integrations.
• Automate repetitive detection and incident response activities such as evidence collection, enrichment, and ticketing.
• Build and maintain incident response playbooks, runbooks, and supporting procedures.
• Develop and maintain Python, PowerShell, or similar scripts that integrate security tools and data sources.