AI-Driven Detection Engineer - SIEM & Automation

Salt; Amsterdam; On-site; EUR 70,000 - 110,000; Full time

Job summary

Salt is seeking a Detection Engineer to join the Security team in Amsterdam's vibrant tech ecosystem. You will build detections across web, mobile, and API surfaces and tune telemetry to power AI-assisted alerting and automated responses.

The role sits at the intersection of Security Engineering, Software Development, and AI-driven Security Operations. You will implement scalable, safe automation and contribute to incident response playbooks.

Qualifications

• Experience building or operating production software or security systems.
• Hands-on with SIEM platforms and security analytics.
• Strong knowledge of web, mobile, and API threats.
• Proficiency in at least one modern language (Python/Go/Java).
• Experience with AI agents and LLM-powered applications.
• Knowledge of logging, telemetry, event schemas, and data quality.

Responsibilities

• Design, build, test, and maintain security detections and anomaly detection within SIEM platforms.
• Develop detection coverage for threats including account takeover, automated abuse and bot activity, authentication and session misuse, access control failures, and suspicious data access.
• Collaborate with Product, Engineering, and Platform teams to improve logging, telemetry, event coverage, and attribution.
• Build and enhance AI-powered triage capabilities, including tool integrations and decision quality measures.
• Design and implement incident response workflows and investigation playbooks.
• Develop security automation to enrich, route, and respond to security events with auditable processes.

Skills

SIEM platforms

Security analytics

Web security

Mobile security

APIs security

Python

Go

Java

AI agents

LLM-powered applications

SOAR

Incident response

Logging/telemetry

Data quality

Threat hunting

Job description

Salt is seeking a Detection Engineer to join the Security team in Amsterdam's vibrant tech ecosystem. You will build detections across web, mobile, and API surfaces and tune telemetry to power AI-assisted alerting and automated responses.

The role sits at the intersection of Security Engineering, Software Development, and AI-driven Security Operations. You will implement scalable, safe automation and contribute to incident response playbooks.