Detection & Response Security Engineer

CipherData; Bellevue (WA); On-site; USD 120,000 - 170,000; Full time

Job summary

CipherData in Bellevue, WA is seeking a Security Engineer to join a founding security team. You will build detection and correlation content, label real investigations, and work inside customer SOCs as AIDR runs in production. The role grows from hands-on SOC work to owning large components for senior engineers.

You will collaborate with the AI engineering team to move ideas into customer environments within days, tuning detections and enabling reliable outcomes in fast-moving deployments.

Qualifications

• 3+ years in a SOC, detection engineering, threat hunting, or IR
• Written and tuned production detections with FP trade-offs explained
• Experience with at least one SIEM or security data platform and EDR/XDR telemetry
• Working Python; code reviews, tests, and CI
• Comfort with ambiguity and ownership at an early-stage startup

Responsibilities

• Write, test, tune, and retire the detection logic and correlation rules that turn multi-vendor security data into signal our agents can reason over
• Label real investigations into benchmark datasets and document cases where agent output is confidently wrong
• Track attacker tradecraft and turn it into detection content, test cases, and agent capability
• Contribute to normalization, enrichment, and query patterns on our SIEM-less security lakehouse as we expand it
• Help deploy, tune, and validate AIDR in customer environments and carry analyst feedback back into detection and evaluation
• Participate in customer-reported and internal incident response, including analysis, documentation, and post-incident review

Skills

SOC experience

Detection tuning

Python

CI/CD

Ownership

Tools

SIEM

EDR/XDR

Job description

CipherData in Bellevue, WA is seeking a Security Engineer to join a founding security team. You will build detection and correlation content, label real investigations, and work inside customer SOCs as AIDR runs in production. The role grows from hands-on SOC work to owning large components for senior engineers.

You will collaborate with the AI engineering team to move ideas into customer environments within days, tuning detections and enabling reliable outcomes in fast-moving deployments.