AI-Driven Detection Engineer: Build Behavioral Detections

Artemis; United States; Remote; USD 100,000 - 160,000; Full time

Job summary

Artemis is seeking a Detection Engineer to own high-fidelity detections across cloud, identity, endpoint, and SaaS sources. You will design, build, test, and continuously tune detections as code, using AI to accelerate authoring and validation.

The role feeds an AI-native investigation pipeline with rich, machine-readable output to empower precise threat hunting. Responsibilities include building and maintaining the detection library, validating against real attacks, and collaborating with

Qualifications

• 5+ years of hands-on cybersecurity experience with significant time in detection engineering.
• Proven track record designing, building, and tuning detections at scale across SIEM/EDR or custom detection platforms.
• Strong proficiency in detection languages and formats such as Sigma, KQL, SPL, or YARA-L, and comfort writing code (Python) for automation and testing.
• Deep knowledge of attacker tactics, techniques, and procedures (MITRE ATT&CK) and how they manifest in logs across cloud, identity, endpoint, and SaaS telemetry.
• Experience with detection-as-code workflows: Git, peer review, automated testing, and CI/CD for detection content.
• Experience using AI tools to accelerate detection authoring, tuning, or validation.
• Experience building behavioral or anomaly-based detections: establishing baselines of normal activity and engineering detections that flag meaningful deviations.
• Strong log-analysis skills and ability to distinguish malicious activity from benign noise across diverse data sources.
• Clear written and verbal communication — able to document detection logic and explain coverage and trade-offs to engineers, analysts, and customers.

Responsibilities

• Build and maintain the detection library across cloud, identity, endpoint, and SaaS log sources.
• Practice detection-as-code with version-controlled rules, peer review, automated validation, and CI/CD deployment.
• Map and close coverage gaps using MITRE ATT&CK as a baseline.
• Validate detections against real attacks with attack simulations and test harnesses.
• Tune false positives/negatives and retire obsolete detections.
• Use AI to author, convert, test, and document rules for scalable detection content.
• Build behavioral and anomaly-based detections with baselines and deviations.
• Engineer detections to support AI-powered investigation workflows.
• Translate threat intelligence and findings into durable, behavioral detection logic.
• Partner with SOC and research teams to iterate detection improvements and create investgable alerts.
• Support customer-specific tuning of detection content to environments.

Skills

Detection engineering

SIEM/EDR detections

Detection languages

Python

MITRE ATT&CK knowledge

AI-assisted detection

Anomaly detection

Communication skills

Tools

Git

CI/CD

Automation tooling

Atomic Red Team

Job description

Artemis is seeking a Detection Engineer to own high-fidelity detections across cloud, identity, endpoint, and SaaS sources. You will design, build, test, and continuously tune detections as code, using AI to accelerate authoring and validation.

The role feeds an AI-native investigation pipeline with rich, machine-readable output to empower precise threat hunting. Responsibilities include building and maintaining the detection library, validating against real attacks, and collaborating with