Detection Engineer Endpoint Security Engineer

Hexnode; Chennai; On-site; INR 1,800,000 - 2,600,000; Full time

Job summary

Hexnode is expanding its XDR endpoint stack, including a Windows kernel driver and agents for Windows and macOS. This role focuses on turning telemetry into reliable detections that fire on real adversary behavior, with end-to-end ownership from rule creation to testing and documentation.

You will work in a lab with instrumented endpoints to validate detections, tune out false positives, and document coverage.

Qualifications

• 2–4 years in detection engineering, threat hunting, SOC L2/L3, or endpoint security product engineering.
• Windows internals as they surface in telemetry — processes, threads and handles; services; the registry; scheduled tasks; PE files and Authenticode signing; the Security event log and logon types; common LOLBins.
• Sysmon or equivalent EDR telemetry
• Detection rule tuning – you’d rather say “this rule will be noisy, here’s its hit rate against our goodware corpus” than ship it and learn from customers.
• MITRE ATT&CK fluency — can go from technique to detection logic to test case without being walked through it.
• Scripting in PowerShell and Python — enough to build own tooling, not just run someone else’s.
• Rule authoring, static PE analysis, and similarity hashing — imphash, ssdeep, TLSH.
• Malware triage and unpacking.
• Exposure to Microsoft’s AV ecosystem — MVI, ELAM, AMSI, ETW Threat Intelligence — or to independent lab testing.
• macOS endpoint telemetry via the Endpoint Security framework.
• GitLab and Jira in a product engineering workflow.

Responsibilities

• Author, tune and maintain detection rules for endpoint threats, and keep coverage mapped to MITRE ATT&CK.
• Translate techniques into concrete detection logic against the events our driver and agent emit.
• Retire and replace detections that no longer earn their keep.
• Build benign emulations that reproduce telemetry signatures of techniques without shipping offensive capability.
• Compare what a detection needs against what the agent and driver emit today, and write concrete telemetry requests.
• Contribute to data-model decisions for endpoint events.
• Draft exclusion and whitelist filter logic and detection tuning, for review before deployment.
• Help maintain the goodware corpus and prevalence gating that back release-gate regression runs.
• Benchmark how competitors implement a given capability and write up the tradeoffs.
• Maintain a living ATT&CK coverage matrix.

Skills

Windows internals

MITRE ATT&CK fluency

PowerShell

Python scripting

Detection rule tuning

Endpoint telemetry analysis

Malware triage

Tools

Sysmon

imphash

ssdeep

TLSH

GitLab

Jira

Job description

Job Description

About Mitsogo| Hexnode

Hexnode is a global leader in Unified Endpoint Management (UEM), trusted by over 100 countries and managing millions of devices worldwide. With a rapid pace of innovation, we have established ourselves as a dominant force across Apple, Windows, Android, macOS, Linux, and tvOS. Fuelling the transformation to a seamless ecosystem of connected tools, Hexnode is revolutionizing the enterprise software and cybersecurity landscape.

Job Overview

We build Hexnodes XDR endpoint stack — a Windows kernel driver, Windows and macOS agents, and the server and console behind them. The driver and agents already emit a broad telemetry surface: process creation and termination, process access, image load, driver load, thread creation, registry key and value operations, network connections, DNS queries and file activity. We are actively extending the platform with advanced features.

Telemetry on its own catches nothing. This role exists to turn that telemetry into detections that fire on real adversary behaviour, prove they fire, and keep them quiet enough that an analyst trusts them. You will own detection content end to end: write the rule, emulate the technique, verify the telemetry supports it, tune out the false positives, and document what we cover and what we dont.

This is a hands-on engineering role, not an alert-queue role. You will spend your time in a lab with instrumented endpoints, in detection logic, and in the gap between what an attack does and what our sensors see.

Key Responsibilities

Detection content :

• Author, tune and maintain detection rules for endpoint threats, and keep coverage mapped to MITRE ATT&CK.

• Translate techniques into concrete detection logic against the events our driver and agent emit

• Retire and replace detections that no longer earn their keep.

Adversary emulation and detection testing :

• Build benign emulations that reproduce the telemetry signature of a technique without shipping working offensive capability or live C2 into an internal build.

Telemetry gap analysis :

• Compare what a detection needs against what the agent and driver emit today, and write up concrete, implementable telemetry requests for the driver and agent teams.

• Contribute to data-model decisions for endpoint events

• Flag where a proposed detection is not implementable with current sensors, early enough to change the plan.

False positive reduction :

• Triage alert noise from internal and customer telemetry; assemble false-positive candidates with evidence rather than anecdote.

• Draft exclusion and whitelist filter logic and detection tuning, for review before deployment.

• Help maintain the goodware corpus and prevalence gating that back our release-gate regression runs.

Research and documentation :

• Benchmark how competitors implement a given capability and write up the tradeoffs.

• Maintain a living ATT&CK coverage matrix — the artifact that answers “what do we detect, and how do we know” without anyone guessing.

Requirements

• 2–4 years in detection engineering, threat hunting, SOC L2/L3, or endpoint security product engineering.

• Windows internals as they surface in telemetry — processes, threads and handles; services; the registry; scheduled tasks; PE files and Authenticode signing; the Security event log and logon types; common LOLBins.

• Sysmon or equivalent EDR telemetry

• Detection rule tuning – Youd rather say “this rule will be noisy, heres its hit rate against our goodware corpus” than ship it and find out from a customer.

• MITRE ATT&CK fluency — Can go from technique to detection logic to test case without being walked through it.

• Scripting in PowerShell and Python — enough to build own tooling, not just run someone elses.

• Rule authoring, static PE analysis, and similarity hashing — imphash, ssdeep, TLSH.

• Malware triage and unpacking.

• Exposure to Microsofts AV ecosystem — MVI, ELAM, AMSI, ETW Threat Intelligence — or to independent lab testing (AV-Comparatives, AV-TEST).

• macOS endpoint telemetry via the Endpoint Security framework.

• GitLab and Jira in a product engineering workflow.