Senior Detection & Response Engineer - Remote (UK)

VulnCheck Inc.; Cheltenham; Hybrid; GBP 90,000 - 130,000; Full time

Job summary

VulnCheck is seeking a Senior Detection and Response Engineer to design scalable, AI-assisted detections for internet-facing assets. You will ship network and host signatures, evaluate detection quality, and collaborate with vulnerability researchers to align detection with exploit intelligence.

Although this is a remote role, candidates should be located in or around Cheltenham, United Kingdom, and be prepared to engage across the full detection lifecycle from data collection to threat

Qualifications

• 5+ years of experience building and shipping durable detections over network and host data.
• Experience scaling detection development and continuous evaluation processes using AI and agentic workflows with humans on the loop.
• A track record of researching, engineering, and validating durable detections across network and host telemetry, with a disciplined approach to false positives and false negatives.
• Expertise in device fingerprinting and protocol analysis. You understand the nuances of how services manifest on the wire, and how these signals stack to passively uncover what is running behind an open port on an internet address
• Knowledge of attacker command-and-control techniques, covert channels, and exploitation artifacts — and how to identify them through network traffic analysis
• A background in host-based analysis and DFIR. You know what telemetry is worth collecting from sensors to identify exploitation activity and attacker behaviors, and how to synthesize it into high-quality, actionable threat intelligence
• Strong programming or scripting ability — you can codify detection logic so it is performant and integrates cleanly with VulnCheck’s engineering system
• Familiarity with CVE, NVD, KEV, or exploit intelligence datasets
• A response mindset — when a new vulnerability drops, you’re the first to dig in, analyze it, and ship detection coverage

Responsibilities

• Design and direct AI-assisted, agentic detection workflows that scale coverage to an accelerating volume of vulnerabilities, with you on the loop for quality
• Author and ship network signatures and detections against internet-scale scan and probe data to identify services, versions, and whether hosts are vulnerable.
• Build detections against Canary telemetry that separate real exploitation signal from internet noise, and synthesize that signal into threat intelligence customers can act on
• Drive feedback loops into our probing and collection capabilities - identifying what data we should collect, what we shouldn’t, and where coverage gaps exist
• Continuously evaluate detection quality, measuring and tuning false positive and false negative rates
• Respond rapidly when high-impact vulnerabilities drop - analyze, build coverage, ship
• Work alongside our vulnerability researchers and threat hunters to connect detection engineering with exploit intelligence

Skills

Durable detections

AI-assisted workflows

Network telemetry

Host telemetry

Programming/scripting

CVE/NVD/KEV knowledge

Threat intelligence

False positives management

Protocol analysis

Device fingerprinting

Tools

Suricata

Snort

Zeek

Nuclei

Job description

VulnCheck is seeking a Senior Detection and Response Engineer to design scalable, AI-assisted detections for internet-facing assets. You will ship network and host signatures, evaluate detection quality, and collaborate with vulnerability researchers to align detection with exploit intelligence.

Although this is a remote role, candidates should be located in or around Cheltenham, United Kingdom, and be prepared to engage across the full detection lifecycle from data collection to threat