Detection Engineer

Crane Venture Partners; Paris; Sur place; EUR 45 000 - 57 000; Plein temps

Avantages offerts par ce poste

Flexible remote work

Health insurance (Alan)

Meal vouchers (Swile)

Mentor program

GymLib access

Résumé du poste

HarfangLab, a French cybersecurity scale-up in Paris, seeks a Detection Engineer to enhance EDR detections by turning threat intel into actionable detections. You will design Sigma and YARA rules, validate rule quality, and strengthen protection against evolving threats.

You will join a 7-person team in Paris with flexible remote options, strong autonomy, and opportunities to drive your own projects while partnering with security customers and partners.

Qualifications

• 2–3+ years in Cyber Threat Intelligence, Detection Engineering, Malware Analysis, or related cybersecurity field.
• Proficient in Python; working knowledge of Rust and/or C.
• Strong understanding of Windows, Linux, and macOS internals.
• Experience creating and maintaining detection rules (YARA, Sigma, IDS/IPS, EDR).
• Fluent in French and English; able to communicate technical topics clearly.

Responsabilités

• Improve EDR detection capabilities by transforming threat intelligence into detections.
• Design, develop, and maintain Sigma rules for behavioral detections and YARA rules for malware.
• Validate, tune, and monitor detection rules to minimize false positives.
• Research new detection opportunities and prototype improvements to strengthen the engine.
• Develop internal tools to accelerate threat research and detection workflows.

Connaissances

Cyber Threat Intelligence

Detection Engineering

Malware Analysis

Python

Rust/C

Windows internals

Linux internals

French & English

Outils

Sigma rules

YARA rules

IDS/IPS detections

EDR detections

Description du poste

Who we are?

HarfangLab is a French scale‑up specializing in cybersecurity that develops EDR(Endpoint Detection and Response), EPP(Endpoint Protection Platform), and ASM(Attack Surface Management) solutions to detect and neutralize modern cyberattacks targeting an organization’s workstations and servers. Our engines, models, and algorithms identify abnormal behaviors and either generate security alerts or block program execution.

Since our creation in 2018, HarfangLab’s technology has received strong industry recognition, earning prestigious distinctions and becoming the first EDR to be certified by ANSSI in 2020, and later the first to obtain ANSSI qualification in 2025. We are also proud to have joined the French Tech 2030 program alongside 80 other innovative French companies, at a time when cyber resilience has become a major strategic priority for Europe.

We have raised a total of €30 million, enabling us to strengthen our teams, growing from 40 employees in 2023 to 130 today, and expand internationally across Europe.

Today, HarfangLab protects the endpoints of more than 800 clients of all sizes and across all sectors: CAC 40 industrial companies, government entities, SMEs, hospitals, and local authorities. With a strong collective spirit and international ambitions, HarfangLab continues its expansion while remaining true to its original mission: protecting organizations against increasingly complex cyber threats while enabling clients to retain full control over their data.

Why are we hiring?

The company's growth continues, and our ecosystem of technology partners is expanding day by day. We are receiving more and more requests to integrate our product with other cybersecurity solutions.

What you will do with us?

• As a Detection Engineer, you will be responsible for improving our EDR detection capabilities by transforming threat intelligence into actionable detections. You will continuously monitor the threat landscape, design and maintain Sigma and YARA rules, validate detection quality, and identify opportunities to strengthen the product against new attack techniques.
• Continuously monitor the threat landscape and analyze emerging threats, malware, and attacker techniques.
• Design, develop, and maintain detection content, primarily Sigma rules for behavioral detections and YARA rules for malware identification.
• Validate, tune, and monitor detection rules to ensure their effectiveness while minimizing false positives.
• Research new detection opportunities and prototype improvements to strengthen the EDR detection engine.
• Develop internal tools and automation to accelerate threat research and detection engineering workflows.
• Contribute to threat reports, blog posts, and internal or external communications on the evolving threat landscape.
• Provide technical guidance and expertise to selected customers when required.

About you

Soft Skills

• Strong interest in cybersecurity and Cyber Threat Intelligence.
• Reliable, diligent, and collaborative.
• Curious, proactive, resourceful, and able to work autonomously.
• Passionate about learning, sharing knowledge, and discussing technical topics.

Hard Skills

• At least 2–3+ years of hands‑on experience in Cyber Threat Intelligence, Detection Engineering, Malware Analysis, or a related cybersecurity field.
• Proficient in Python with working knowledge of Rust and/or C.
• Strong understanding of Windows, Linux, and ideally macOS internals.
• Experience in system and/or network administration.
• Good knowledge of attack techniques and adversary tradecraft.
• Hands‑on experience in malware reverse engineering.
• Experience creating and maintaining detection rules (YARA, Sigma, IDS/IPS, EDR detections). This is a key requirement for the role.
• Fluent in French and English.
• Familiar with AI‑powered tools and their application to CTI activities.

Bonus Skills

• Incident Response experience.
• Red Team / Penetration Testing experience.
• Blue Team / SOC experience.
• Experience tracking threat actors and producing actionable threat intelligence.

What you can expect from your future team?

You will evolve inside a team of 7 people who are very keen to continuously make sure the product is able to efficiently detect cyberthreats. Like every team at HarfangLab, we have a lot of autonomy, and we have great confidence in our colleagues. You will also be able to drive your own projects based on your preferences.

About us

Our office and Team Life:

• Offices located in the heart of Paris, near Bourse (75002)
• High‑quality equipment based on preferences and needs (PC, Mac, additional screens, etc.)
• Thanks to our Office Manager, we regularly organize events such as seminars, happy hours, themed evenings, and more
• An onboarding process to welcome each new colleague with an explanation of the roles and a mentor to support you during your early days!
• A great team that always seeks to improve their skills

And more:

• An attractive package: Base salary 45 K€ to 57 K€ + profit sharing
• Flexible remote work options
• A mentor to guide you throughout your probationary period
• Health insurance: The best health insurance with Alan
• Meal vouchers: We use the Swile card and also have access to a discount platform through our works council
• 7 to 11 additional days off (RTT) per year, in addition to the 25 days of paid vacation. GymLib subscription, covered 80% by HarfangLab
• Access to training and events of your choice and according to your professional needs

Le processus de recrutement

1. A 30‑minute Visio with our Talent Acquisition Specialist
2. A 30 minute Visio with the lead
3. A test to assess your skills
4. A 1.5 hour on‑site interview including a team fit
5. A final HR video appointment to review your soft skills and motivations.