Remote Detection Engineer II - Security & SOAR

EngineersOfAI; United States; Hybrid; USD 130,000 - 180,000; Full time

Job summary

Instacart is expanding its Detection Engineering team within Security to build and operate systems that surface threats across a large grocery technology platform. You will develop high-fidelity detection logic, hunt for attacker techniques, and drive coverage, quality, and scale with a detection-as-code mindset.

You’ll work with Engineering, Red Team, Incident Response, Fraud, and Trust & Safety to ensure detections reflect real-world adversary behavior, and you’ll help reduce noise while

Qualifications

• Minimum 2+ years in detection engineering, incident response, or offensive security.
• Experience with one or more public cloud platforms (AWS, Azure, GCP).
• Deep understanding of attacker TTPs across modern environments.
• Proficiency in macOS internals and telemetry.
• Experience implementing detection-as-code workflows with VCS, automated testing, and CI/CD.
• Proficiency in Python or Golang.
• Relevant certifications (GCFA, GCFE, GNFA, GREM, OSCP, GCIA or similar).

Responsibilities

• Develop, tune, document, and maintain detection logic across multiple log sources (endpoint, cloud, container, SaaS).
• Assist in cyber forensic investigations across various log sources.
• Optimize log ingestion pipelines and telemetry to balance quality, volume, and cost.
• Design and build SOAR playbooks and automation workflows for triage and response.
• Mentor other detection engineers on threat hunting, detection logic, and investigation techniques.

Skills

2+ years in detection/security

Cloud platforms AWS/Azure/GCP

Attacker TTPs knowledge

macOS internals telemetry

Detection-as-code workflows

Python or Go

Cyber security certifications

Job description

Instacart is expanding its Detection Engineering team within Security to build and operate systems that surface threats across a large grocery technology platform. You will develop high-fidelity detection logic, hunt for attacker techniques, and drive coverage, quality, and scale with a detection-as-code mindset.

You’ll work with Engineering, Red Team, Incident Response, Fraud, and Trust & Safety to ensure detections reflect real-world adversary behavior, and you’ll help reduce noise while