Senior Security Engineer, Detection Engineering

About the role

NVIDIA Security is seeking a Senior Detection Engineer to join the Detection and Automation Engineering team. On this team, we build reliable detection coverage that helps responders identify real threats quickly, reduce unnecessary noise, and protect NVIDIA's enterprise, cloud, developer, AI, and production environments. Do you enjoy turning sophisticated security signals into detections responders can trust? Can you read an incident write-up, a red-team result, or an unusual authentication pattern and decide what is worth alerting on? We want someone who can move from hypothesis to tested production content and explain the tradeoffs clearly. We work closely with incident response, threat intelligence, security operations, cloud security, and engineering teams. We protect enterprise, cloud, identity, endpoint, collaboration, developer, AI, and production environments. We care about detections that are explainable, measured, maintainable, and useful during real investigations.

Responsibilities

• Build and tune high-confidence detections across platforms such as Splunk, Microsoft Sentinel / Defender, CrowdStrike, cloud-native logs, identity telemetry, endpoint data, SaaS platforms, and developer systems.
• Translate incidents, hunts, threat intelligence, red-team findings, and vulnerability context into detection logic we can test and operate.
• Investigate real telemetry before we alert on it, including field behavior, timing, joins, baselines, and the false positives a responder will actually see.
• Drive the full detection lifecycle: design, query development, validation, peer review, documentation, deployment, tuning, monitoring, and retirement.
• Strengthen detection-as-code workflows, including test data, quality checks, metadata, rollout safety, coverage tracking, and detection health reporting.
• Partner with responders to cut noise, add useful context, improve severity decisions, and build follow-up detections after investigations.
• Shape logging, normalization, enrichment, and retention requirements when the telemetry we need is missing or hard to use.
• Coach analysts and engineers through design reviews, query reviews, and clear guidance on what makes a detection credible.

Requirements

• 8+ years of experience in detection engineering, security engineering, threat hunting, incident response, SOC engineering, or information security monitoring.
• A degree in Computer Science, Cybersecurity, Engineering, or equivalent experience.
• Hands-on experience building and tuning detections in a major SIEM or security analytics platform.
• Strong query and scripting skills, especially SPL, KQL, SQL, Python, or similar languages used to analyze security telemetry and automate repetitive work.
• Practical understanding of attacker behavior across identity, endpoint, cloud, network, email, collaboration tools, developer infrastructure, secrets, and data theft.
• Ability to move from raw logs