Remote Detection Engineer: Build, Automate & Detect

Totem Market Valuations; Houston (TX); On-site; USD 110,000 - 165,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

401k match

Flexible remote-friendly environment

Training opportunities

Job summary

Binary Defense is seeking an experienced Detection Engineer to join our Detection Engineering team. You’ll design, implement, and maintain detections across SIEMs, EDRs, and cloud environments in an automation-driven setup.

You’ll work with threat intel, IR, and cloud security to develop threat-informed detections, contribute to detection-as-code pipelines, and improve telemetry readiness across Windows logs, Sysmon, and cloud audits.

Qualifications

• 2–5+ years of hands-on experience in detection engineering, threat hunting, or incident response.

Responsibilities

• Design and implement detections across SIEM and EDR platforms using a detection-as-code approach.
• Develop and operationalize detection logic in YAML/Sigma/YARA-L, with documentation and testing.
• Automate rule deployment, validation, and telemetry inspection via APIs.
• Collaborate with Threat Intel, IR, and Cloud Security to create threat-informed detections.
• Contribute to threat modeling to identify high-value detection opportunities and gaps.
• Analyze telemetry sources (Windows Event Logs, Sysmon, cloud logs, network traffic) for detections.
• Participate in adversary simulations and detection validation using tools like Atomic Red Team or Caldera.
• Document detection logic, coverage rationale, and response guidance.
• Improve detection engineering workflows, tooling, and standards continuously.

Skills

Python

REST APIs

Sigma/YARA-L

SIEM/EDR

Threat modeling

MITRE ATT&CK

Telemetry analysis

YAML

IR/Threat hunting

Tools

Splunk

Microsoft Sentinel

CrowdStrike

Cortex XDR

Chronicle

Job description

Binary Defense is seeking an experienced Detection Engineer to join our Detection Engineering team. You’ll design, implement, and maintain detections across SIEMs, EDRs, and cloud environments in an automation-driven setup.

You’ll work with threat intel, IR, and cloud security to develop threat-informed detections, contribute to detection-as-code pipelines, and improve telemetry readiness across Windows logs, Sysmon, and cloud audits.