Senior Detection Engineer — Remote/Hybrid

LinkedIn; United States; Hybrid; USD 129,000 - 212,000; Full time

Job summary

LinkedIn in the United States is seeking a Senior Security Engineer focused on detection engineering to design, build, and operate high-signal detections across endpoints, cloud, and SaaS environments.

You will apply detections-as-code, telemetry modeling, and data-driven efficacy measurements to improve coverage, reduce noise, and support incident response.

This hands-on role requires technical leadership and cross-functional collaboration, including on-call rotations for critical pipelines.

Qualifications

• BA/BS in CyberSecurity, Information Security, Computer Science or related discipline or practical experience.
• 3+ years in security, detection engineering or incident response.
• Experience building detection content and analytics for SIEM/XDR/EDR and cloud telemetry.
• Experience programming for detections/automation (Python) and query languages (KQL/SQL/SPL).
• Experience with detections-as-code (tests, CI/CD, canary/rollback) at scale.
• Experience with attacker TTPs (MITRE ATT&CK) and detection efficacy metrics.
• Experience with schemas/data models (OSSEM/ASIM-like) and telemetry pipelines.

Responsibilities

• Implement and tune detection content across SIEM/XDR/EDR and cloud telemetry; measure precision/recall, latency, lift, and signal-to-noise ratio.
• Build detections-as-code with version control, CI/CD, unit/integration tests, staged canary rollouts, and safe rollback.
• Author and maintain SIGMA rules; translate SIGMA to KQL/SQL as needed.
• Operationalize Microsoft Defender XDR and Sentinel signals; leverage Entra ID controls.
• Proactive threat hunting; create hunt playbooks and convert findings into detections.
• Build IR automation (SOAR/Logic Apps) for triage, enrichment, containment, and case workflow; integrate with ticketing/chat ops.
• Operationalize threat intelligence: ingest/normalize IOCs/TTPs, enrich detections with TI context, and turn reports into testable hypotheses.
• Own telemetry quality for assigned pipelines: schemas/normalization, enrichment, data contracts, reliability SLIs/SLOs.
• Participate in incident retros; add post-incident detections and suppress noisy patterns.
• Participate in on‑call for critical detection pipelines and high‑severity investigations.

Skills

Detection engineering

SIEM/XDR/EDR

Python

KQL/SQL

MITRE ATT&CK

Telemetry schemas

On-call readiness

Education

BA/BS in CS or related

Tools

SIGMA

Microsoft Defender XDR

Sentinel

Entra ID

Kusto

Job description

LinkedIn in the United States is seeking a Senior Security Engineer focused on detection engineering to design, build, and operate high-signal detections across endpoints, cloud, and SaaS environments.

You will apply detections-as-code, telemetry modeling, and data-driven efficacy measurements to improve coverage, reduce noise, and support incident response.

This hands-on role requires technical leadership and cross-functional collaboration, including on-call rotations for critical pipelines.