Remote Detection Engineer II — Threat Hunting & SOAR

Bazeta; United States; Remote; USD 142,000 - 150,000; Full time

Benefits offered by this job

Equity grant

Annual refresh grants

Flex First remote policy

Job summary

Instacart is seeking a Detection Engineer II to join our Security team, building and operating detections across endpoint, cloud, and SaaS. You will translate attacker techniques into durable detection logic and contribute to threat hunting initiatives.

The role is remote-friendly within the United States, with flexible work arrangements and opportunities to collaborate across engineering, incident response, and fraud teams. You will mentor others and help scale our detection program.

Qualifications

• 2+ years in detection engineering, incident response, or offensive security.
• Experience with public cloud platforms (AWS, Azure, GCP).
• Deep understanding of attacker TTPs in zero-trust environments.
• Proficient in macOS internals and telemetry for threats.
• Experience with detection-as-code, version control, CI/CD, and automated testing.
• Proficiency in Python or Golang.
• Certifications: GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar.

Responsibilities

• Develop, tune, document, and maintain detection logic across endpoints, cloud, container, and SaaS.
• Assist cyber forensic investigations across diverse log sources.
• Optimize log ingestion pipelines to ensure high-quality, cost-aware data.
• Design and build SOAR playbooks to streamline detection triage and response.
• Mentor other detection engineers on threat hunting and detection development.

Skills

Detection engineering

Incident response

Offensive security

Python

Golang

macOS internals

Threat hunting

CI/CD

Version control

Tools

AWS

Azure

GCP

SOAR

Telemetry tooling

Job description

Instacart is seeking a Detection Engineer II to join our Security team, building and operating detections across endpoint, cloud, and SaaS. You will translate attacker techniques into durable detection logic and contribute to threat hunting initiatives.

The role is remote-friendly within the United States, with flexible work arrangements and opportunities to collaborate across engineering, incident response, and fraud teams. You will mentor others and help scale our detection program.