Detection Engineer

About the role

Copart, Inc. a technology leader and the premier online vehicle auction platform globally, with over 200 facilities located across the world, Copart links vehicle sellers to more than 750,000 buyers in over 190 countries. We believe in providing an unmatched experience, every day and everywhere, driven by our people, processes, and technology. Copart is seeking a curious, engineering-minded Detection Engineer to join our global Security Operations team. You will build the detection content that identifies malicious activity across our endpoint, identity, network, and cloud estate — and prove that it works. Our detections are managed as code: version-controlled, peer-reviewed, and deployed through automation. Much of our authoring and threat-intelligence triage is AI-assisted, with agentic workflows drafting detection logic before an engineer reviews and ships it. We want someone genuinely fluent in working alongside these tools — able to move quickly with them, and clear-eyed about when not to trust them.

Responsibilities

• Detection Authoring & Tuning: Design and author detection logic targeting adversary behaviors across endpoint, identity, network, and cloud telemetry, favoring durable behavioral indicators over brittle atomic ones. Map content to MITRE ATT&CK and maintain complete rule metadata — owner, data sources, severity, lifecycle status. Tune detections using real investigation outcomes, distinguishing logic that is wrong from logic that is right in a noisy environment and applying the correct fix for each.
• Detection-as-Code & Automation: Author detection content as code — rules, macros, lookups — in version control, using standard Git branching and pull request review. Help extend the CI/CD pipeline that validates and deploys content, including schema checks, linting, and automated quality gates. Write scripts and tooling (Python or similar) to automate repetitive work such as coverage reporting and data normalization, and partner with log source engineering to onboard new telemetry.
• AI-Assisted Detection Engineering: Work fluently within AI-assisted and agentic workflows where language models draft detection logic and perform first-pass triage and enrichment. Critically review AI-generated content before it ships, taking full engineering ownership of the output regardless of how it was drafted. Help build and refine the agent skills, prompts, and tool integrations the team relies on, and exercise judgment about where a human must stay in the loop.
• Validation, Detection Health & Measurement: Validate detection logic against historical telemetry and known-good and known-bad events before deployment, rather than relying on review alone. Monitor deployed detections for silent failure — rules that have stopped firing, queries that error, logic broken by schema or environment drift — and treat a detection that never fires as a defect to investigate, not as evidence of a clean environment. Contribute to attack simulation exercises and to program metrics covering coverage, alert fidelity, and detection health, converting every validated miss into detection work.