Detection Engineer

VulnU; United Kingdom; Remote; GBP 65,000 - 95,000; Full time

Job summary

Darktrace in the United Kingdom is seeking a Detection Engineer to help advance our threat detection model deck. You will work in a small global team, responding to incidents and customer requests while refining detections and intelligence.

The role emphasises independence, collaboration with Development, Analyst and customer-facing teams, and ongoing improvements to tooling. Experience with Darktrace products and endpoint security is highly valued.

Qualifications

• Hands-on experience using the Darktrace product suite for investigations and analysis.
• Experience with the Platform model editor to assist customers with creating or tuning models.
• Ability to work independently, pro-actively and drive improvements to the model deck.
• Familiarity with a range of Darktrace products (Network, Identity, Cloud, Response, Endpoint).
• Strong analytical skills and ability to prioritise tasks.

Responsibilities

• Build out new model decks covering areas such as Endpoint and Kubernetes.
• Address customer queries and respond to cyber incidents, prioritising time-sensitive issues.
• Analyse cybersecurity incidents in depth to identify improvement areas for the model deck.
• Drive development of new models and refine existing ones.
• Collaborate with Development, Analyst, and customer-facing teams to deliver outcomes.
• Develop and enhance internal tooling and processes.

Skills

Threat detection

Investigation

Model deck

Independent work

Analytical skills

Time management

Tools

GitLab

Platform model editor

Endpoint telemetry

Darktrace product suite

Job description

Darktrace is a global leader in AI-driven cybersecurity, helping organizations stay ahead of evolving threats every day. Darktrace was built on a genuinely differentiated idea: that Adaptive AI could detect and respond to novel, real-time cyber threats. That approach matters more than ever in the era of AI. Today, our customers depend on us to stay ahead. At Darktrace, we are energized by that responsibility. We work across teams and rally around a shared goal. We own outcomes end to end - step in, step up and see things through without waiting to be asked. We make decisions with urgency, say the hard thing, and hold each other to high standards with care and directness. We move first and learn fast anticipating where our customers are going next, continuously challenging ourselves. We invest in the skills, learning and opportunities that help people deliver at the level their roles demand, and reward the aptitude and curiosity to grow beyond them. Our Values: Own It | Win as One | Raise Our Bar | Move First. Learn Fast Job Description:What will I be doing?As a Detection Engineer, you will be working in a small, global team, working on the continuous development of our threat detection model deck, whilst responding to customer requests and incidents, and reviewing and processing cyber threat intelligence.You will be expected to:Work on building out new model decks to cover areas such as Endpoint and KubernetesAddress customer queries and respond to cyber incidents, prioritising time-sensitive and high-priority issuesAnalyse cybersecurity incidents in depth, to be able to identify areas for improvement of the model deckSelf-drive development of new models, and identify areas for improvement of existing modelsCollaborate with various stakeholders within Darktrace, such as Development, Analyst, and customer-facing teamsDevelop and enhance internal tooling and processesWhat experience do I need?To be suited for the role, you must have hands-on experience using the Darktrace product suite to carry out thorough investigations, analysing model alerts and associated traffic/activity in depth.You should also have some experience with the Platform model editor, e.g. assisting customers with creating custom models, or tuning existing models.You will also be expected to be able to work independently, pro-actively and be self-driven; you will be responsible for driving improvement of the model deck.Other prerequisites for the role:Familiarity with a range of Darktrace products, including Network, Identity, Cloud, Response, EndpointKnowledge of basic cybersecurity concepts, and a passion for staying up-to-date on the latest cybersecurity trendsStrong analytical skills, and an ability to solve problems creativelyStrong time management and prioritisation skillsBeneficial skills:Experience working with endpoint based security platformsExperience building detections with endpoint telemetryExperience working with GitlabExperience in any programming languageBenefits:23 days’ holiday all public holidays, rising to 25 days after 2 years of service,Additional day off for your birthday,Private medical insurance which covers you, your cohabiting partner and children,Life insurance of 4 times your base salary,Salary sacrifice pension scheme,Enhanced family leave,Confidential Employee Assistance Program,Cycle to work scheme.As a growing business strengthening its governance and controls, this role plays a part in supporting high standards of integrity and accountability. Darktrace is an Equal Opportunity Employer. We consider all qualified applicants for employment without regard to race, color, religion, sex (including pregnancy, childbirth, and related medical conditions), sexual orientation, gender identity or expression, national origin, age, disability, genetic information, marital status, veteran or military status, or any other characteristic protected by applicable federal, state, or local law.Darktrace is committed to providing reasonable accommodations to qualified individuals with disabilities in accordance with applicable laws. If you require a reasonable accommodation to participate in the application or interview process, please contact your Talent Partner.