Datadog Cloud SIEM Detection Engineer | AI & Automation

Beyond Finance; United States; Remote; USD 100,000 - 120,000; Full time

Benefits offered by this job

Health, dental, and vision programs

PTO and paid holidays

401(k) matching

Career development & training

Job summary

Beyond Finance is seeking a Detection & Response Engineer to build detections and automation for cloud, SaaS apps, and endpoints. You will own Datadog configurations, detections, and incident response workflows, elevating security telemetry into actionable insight.

The ideal candidate brings 3+ years in security operations with hands-on Datadog, scripting, and CI/CD experience; familiarity with MITRE ATT&CK and cloud telemetry is a plus.

Qualifications

• 3+ years in security operations, detection engineering, or security engineering.
• You write your own scripts and build detection logic as code; Infrastructure as code and CI/CD experience is a plus.
• Deep hands-on Datadog experience, especially Cloud SIEM detection rules and log pipelines.
• Experience with automation orchestration tooling.
• Working knowledge of MITRE ATT&CK; threat hunting or purple teaming experience is a plus.
• Experience with security telemetry from cloud platforms, SaaS apps, and EDR.
• You can take a project from prototype to production with little direction.

Responsibilities

• Detection engineering: write, tune, and retire Cloud SIEM detections, and map coverage to MITRE ATT&CK to close gaps.
• Logging pipeline: onboard sources and build Datadog log pipelines that parse, normalize, and enrich security telemetry.
• Detection-as-code: manage detections in version control with testing and peer review.
• Automation: build workflows for alert enrichment, triage, containment, and notification.
• AI in the SOC: build AI-assisted triage and alert summarization, with a human in the loop.
• Measurement: track coverage, false-positive rate, and automation rate to decide what to fix next.
• Filtering and cost: manage indexes, exclusion filters, and retention tiers to cut noise and cost without losing coverage.
• Security operations: support triage, investigations, and incident response, including on-call.

Skills

Datadog Cloud SIEM

Scripting & automation

MITRE ATT&CK knowledge

CI/CD experience

Cloud telemetry experience

Tools

Python

Terraform

CI/CD tooling

Job description

Beyond Finance is seeking a Detection & Response Engineer to build detections and automation for cloud, SaaS apps, and endpoints. You will own Datadog configurations, detections, and incident response workflows, elevating security telemetry into actionable insight.

The ideal candidate brings 3+ years in security operations with hands-on Datadog, scripting, and CI/CD experience; familiarity with MITRE ATT&CK and cloud telemetry is a plus.