Security Engineer (Detection)

Salt; Amsterdam; On-site; EUR 70,000 - 110,000; Full time

Job summary

Salt is seeking a Detection Engineer to join the Security team in Amsterdam's vibrant tech ecosystem. You will build detections across web, mobile, and API surfaces and tune telemetry to power AI-assisted alerting and automated responses.

The role sits at the intersection of Security Engineering, Software Development, and AI-driven Security Operations. You will implement scalable, safe automation and contribute to incident response playbooks.

Qualifications

• Experience building or operating production software or security systems.
• Hands-on with SIEM platforms and security analytics.
• Strong knowledge of web, mobile, and API threats.
• Proficiency in at least one modern language (Python/Go/Java).
• Experience with AI agents and LLM-powered applications.
• Knowledge of logging, telemetry, event schemas, and data quality.

Responsibilities

• Design, build, test, and maintain security detections and anomaly detection within SIEM platforms.
• Develop detection coverage for threats including account takeover, automated abuse and bot activity, authentication and session misuse, access control failures, and suspicious data access.
• Collaborate with Product, Engineering, and Platform teams to improve logging, telemetry, event coverage, and attribution.
• Build and enhance AI-powered triage capabilities, including tool integrations and decision quality measures.
• Design and implement incident response workflows and investigation playbooks.
• Develop security automation to enrich, route, and respond to security events with auditable processes.

Skills

SIEM platforms

Security analytics

Web security

Mobile security

APIs security

Python

Go

Java

AI agents

LLM-powered applications

SOAR

Incident response

Logging/telemetry

Data quality

Threat hunting

Job description

Duration: 12 months

Start: ASAP

We are looking for a Detection Engineer to join the Security team and help build and enhance our capabilities for detecting and responding to threats across web applications, mobile applications, APIs, and supporting services.

This role sits at the intersection of Security Engineering, Software Development, and AI-driven Security Operations. You will develop and tune security detections, improve the telemetry that powers them, enhance AI-assisted alert triage capabilities, and build safe, scalable response automation. The ideal candidate combines strong security analytics expertise with hands‑on software engineering skills and experience working with AI-powered systems.

Responsibilities

• Design, build, test, and maintain security detections and anomaly detection capabilities within SIEM platforms.
• Develop detection coverage for threats including:
• Account takeover
• Automated abuse and bot activity
• Authentication and session misuse
• Access control failures
• Suspicious access to sensitive data
• Collaborate with Product, Engineering, and Platform teams to improve logging, telemetry quality, event coverage, and attribution.
• Build and enhance AI-powered triage capabilities, including:
• Tool integrations
• Decision quality measurement
• Design and implement incident response workflows and investigation playbooks.
• Develop security automation that safely enriches, routes, and responds to security events.
• Implement automation controls including approvals, auditability, monitoring, rollback mechanisms, and failure handling.
• Continuously evaluate detection effectiveness, investigate gaps, reduce false positives, and improve operational outcomes using responder feedback.
• Apply software engineering best practices including version control, testing, backtesting, and staged deployments.

Required Skills & Experience

• Experience building or operating production software or security systems.
• Hands-on experience with:
• SIEM platforms
• Security analytics
• Strong understanding of web, mobile, and API security threats.
• Proficiency in at least one modern programming language such as:
• Python
• Go
• Java
• Experience building, integrating, or extending AI agents and LLM-powered applications.
• Knowledge of:
• Agent orchestration
• Tool integrations
• LLM evaluation
• AI safety controls
• Strong understanding of logging, telemetry, event schemas, and data quality.
• Experience designing and deploying automation in secure production environments.
• Excellent communication skills with the ability to collaborate across Security, Engineering, and Platform teams.
• Behavioural analytics and anomaly detection.
• Machine learning applied to security use cases.
• Security orchestration and automated response (SOAR).
• Incident response and containment workflows.
• Web and mobile application security testing.
• Threat hunting and security investigations.