Senior Detection Engineer — EDR Strategy & Validation

Socket.dev; United States; On-site; USD 195,000 - 230,000; Full time

Benefits offered by this job

Inclusive team

Growth opportunities

Innovative culture

Hybrid & Remote work

Competitive compensation

Job summary

Horizon3 is seeking a Senior Detection Engineer to lead the blue team voice inside the Defensible Agent team. You will define what “correct” means when an attack is detected, deciding remediation and ground truth. You will partner with Product, Engineering, and AI research to ground strategy in real-world SOC behavior.

This role emphasizes domain expertise, technical writing, and cross-functional collaboration across teams. The position supports hybrid/remote work with competitive compensation.

Qualifications

• 6+ years in detection engineering, security operations, incident response, or threat hunting.
• Hands-on experience administering and tuning EDR platforms in production.
• Deep understanding of what a SOC actually does with EDR output.
• Fluency in false positive and false negative tradeoffs, alert fatigue, and detection coverage measurement.
• Strong working knowledge of MITRE ATT&CK and detection coverage frameworks.
• Solid understanding of post-compromise attacker behavior and telemetry.

Responsibilities

• Partner with Product to turn EDR effectiveness into concrete, buildable requirements.
• Translate blue team workflows into prioritized product outcomes for SOC readiness.
• Define acceptance criteria for detection, effectiveness, and tuning features; validate releases.
• Serve as the standing domain reference for Engineering and AI research.
• Own knowledge of major EDR platforms and tuning in policy, telemetry, and API level.
• Define tuning recommendations and grade agent output against the standard.

Skills

Detection engineering

EDR tuning

MITRE ATT&CK

Scripting Python

SQL

Technical writing

Cross-functional communication

Tools

Python

SQL

Job description

Horizon3 is seeking a Senior Detection Engineer to lead the blue team voice inside the Defensible Agent team. You will define what “correct” means when an attack is detected, deciding remediation and ground truth. You will partner with Product, Engineering, and AI research to ground strategy in real-world SOC behavior.

This role emphasizes domain expertise, technical writing, and cross-functional collaboration across teams. The position supports hybrid/remote work with competitive compensation.