Security engineer in threat detection

Salt; Amsterdam; Hybrid; EUR 138,000 - 179,000; Full time

Benefits offered by this job

Hybrid: 2 дн./неделю

Job summary

Salt ищет инженера по обнаружению для команды безопасности. Вы будете разрабатывать детекции для веб/мобильных приложений, API и сопутствующих сервисов, настраивать сигналы и улучшать AI‑помощь в triage и ответах на инциденты.

Участвовать в проектах по интеграции IaC и DevSecOps, работая в гибридном формате. Кандидат должен обладать опытом работы с SIEM, безопасностью приложений и языками программирования (Python, Go, Java), а также пониманием контроля качества телеметрии и безопасности

Qualifications

• Опыт работы с продуктивным ПО или системами безопасности.
• Практический опыт работы с SIEM, инженерией обнаружения, аналитикой безопасности и настройкой алертинга.
• Понимание угроз в веб, мобильных и API-системах.

Responsibilities

• Дизайн, построение, тестирование и поддержка детекций и возможностей обнаружения в SIEM.
• Разработка охватаDetections: Account takeover, bot activity, enumeration attacks и т.д.
• Сотрудничество с командами Product, Engineering и Platform для улучшения логирования и телеметрии.
• Разработка AI-управляемой триаж-логики и контекстного обогащения.
• Проектирование инцидент-response процессов и плейбуков расследования.
• Разработка безопасной автоматизации реагирования на security events.
• Установка контроля автоматизации: одобрения, аудитность, мониторинг и откат.
• Постоянная оценка эффективности детекции и снижение FP.

Skills

SIEM platforms

Detection engineering

Security analytics

Alert tuning

Python

Go

Java

Job description

Описание:

We are looking for a Detection Engineer to join the Security team and help build and enhance our capabilities for detecting and responding to threats across web applications, mobile applications, APIs, and supporting services. This role sits at the intersection of Security Engineering, Software Development, and AI-driven Security Operations. You will develop and tune security detections, improve the telemetry that powers them, enhance AI-assisted alert triage capabilities, and build safe, scalable response automation.

Задачи:

Design, build, test, and maintain security detections and anomaly detection capabilities within SIEM platforms. Develop detection coverage for threats including: Account takeover, Automated abuse and bot activity, Enumeration attacks, Authentication and session misuse, Access control failures, Suspicious access to sensitive data. Collaborate with Product, Engineering, and Platform teams to improve logging, telemetry quality, event coverage, and attribution. Build and enhance AI-powered triage capabilities, including: Agent workflows, Tool integrations, Context enrichment, Escalation logic, Decision quality measurement. Design and implement incident response workflows and investigation playbooks. Develop security automation that safely enriches, routes, and responds to security events. Implement automation controls including approvals, auditability, monitoring, rollback mechanisms, and failure handling. Continuously evaluate detection effectiveness, investigate gaps, reduce false positives, and improve operational outcomes using responder feedback. Apply software engineering best practices including version control, testing, backtesting, and staged deployments.

Требования:

Experience building or operating production software or security systems. Hands-on experience with: SIEM platforms, Detection engineering, Security analytics, Alert tuning. Strong understanding of web, mobile, and API security threats. Proficiency in at least one modern programming language such as: Python, Go, Java. Experience building, integrating, or extending AI agents and LLM-powered applications. Knowledge of: Agent orchestration, Tool integrations, Context enrichment, LLM evaluation, AI safety controls. Strong understanding of logging, telemetry, event schemas, and data quality. Experience designing and deploying automation in secure production environments. Excellent communication skills with the ability to collaborate across Security, Engineering, and Platform teams.

Будет плюсом:

• Behavioural analytics and anomaly detection
• Machine learning applied to security use cases
• Security orchestration and automated response (SOAR)
• Incident response and containment workflows
• Web and mobile application security testing
• Threat hunting and security investigations
• Infrastructure as Code (IaC)
• CI/CD and modern DevOps practices

Условия:

• Hourly rate: €100 - €130
• Duration: 12 months
• Hybrid: 2 days per week
• Start: ASAP