Detection Engineer II - Remote Threat Hunter & Automation

Devconnectplatform; United States; Remote; USD 142,000 - 181,000; Full time

Job summary

Instacart is seeking a Detection Engineer II to build and operate detections across endpoint, cloud, container, and SaaS platforms. You will translate attacker techniques into durable detection logic and collaborate with engineering, Red Team, Incident Response, and Trust & Safety to improve coverage and reduce noise.

The role emphasizes detection-as-code with versioned pipelines and automation using SOAR. Remote-friendly within the United States, with a focus on cloud platforms (AWS/GCP/Azure)

Qualifications

• 2+ years of experience in detection engineering, incident response, or offensive security.
• Experience with 1+ public cloud platforms (AWS, Azure, GCP).
• Deep understanding of attacker TTPs across modern zero trust environments, including identity compromise, token theft, and abuse of trust boundaries.
• Proficient understanding of macOS internals and telemetry available to identify macOS specific threats.
• Experience implementing detection-as-code workflows including version control, peer review processes, automated testing, and CI/CD deployment pipelines.
• Basic proficiency with Python, Golang, or other programming/scripting languages.
• Relevant certifications: GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar.

Responsibilities

• Develop, tune, document, and maintain detection logic across multiple log sources including endpoint, cloud, container, and SaaS products.
• Assist in cyber forensic investigations across a variety of log sources.
• Optimize log ingestion pipelines and telemetry collection to ensure high-quality, actionable security data while managing volume and cost.
• Design and build SOAR playbooks and automation workflows to streamline detection triage, enrichment, and response actions.
• Mentor/knowledge share with other detection engineers on threat hunting methodologies, detection logic development, and investigation techniques.

Skills

Detection engineering

Incident response

Threat hunting

Python

Golang

CI/CD

Education

GCFA, GCFE, GNFA, GREM, OSCP, GCIA

Tools

AWS

Azure

GCP

Job description

Instacart is seeking a Detection Engineer II to build and operate detections across endpoint, cloud, container, and SaaS platforms. You will translate attacker techniques into durable detection logic and collaborate with engineering, Red Team, Incident Response, and Trust & Safety to improve coverage and reduce noise.

The role emphasizes detection-as-code with versioned pipelines and automation using SOAR. Remote-friendly within the United States, with a focus on cloud platforms (AWS/GCP/Azure)