Senior Detection Engineer - Remote/Hybrid Cloud & SIEM

LinkedIn; Mountain View (WY); Hybrid; USD 129,000 - 212,000; Full time

Job summary

LinkedIn seeks a senior individual contributor to design, build, and operate high-signal detections across endpoint, identity, cloud, and SaaS environments. You will use detections-as-code, telemetry modeling, and data-driven measurements to improve coverage and quality.

You will work with purple-team exercises, adversary emulation, and incident learnings while collaborating across security, engineering, and product teams.

Qualifications

• BA/BS in CyberSecurity, Information Security, Computer Science or related field or practical experience.
• 3+ years in security, detection engineering or incident response.
• Experience building detection content for SIEM/XDR/EDR and cloud telemetry (Azure/AWS/GCP).
• Experience programming (Python) and query languages (KQL/SQL/SPL).
• Detections-as-code with CI/CD, tests, and canary/rollback practiced at scale.
• Knowledge of MITRE ATT&CK and telemetry schemas/data models.

Responsibilities

• Implement and tune detection content across SIEM/XDR/EDR and cloud telemetry and measure precision and latency.
• Build detections-as-code with version control, CI/CD, tests, staged rollouts and safe rollback.
• Author and maintain SIGMA rules; translate to KQL/SQL as needed.
• Integrate multi-cloud telemetry: Azure, AWS, GCP.
• Operationalize Defender XDR, Sentinel signals and Entra ID controls.
• Proactive threat hunting; create hunt playbooks and convert findings into detections.
• Develop IR automation (SOAR/Logic Apps) for triage and containment.
• Ingest threat intelligence; enrich detections with TI context and test hypotheses.
• Own telemetry quality: schemas/normalization, data contracts and SLIs/SLOs.
• Participate in incident retros; add post-incident detections and suppress noise.
• On-call participation for critical detection pipelines.

Skills

Cybersecurity fundamentals

Detection engineering

SIEM/XDR/EDR

Cloud telemetry

Python

KQL/SQL

MITRE ATT&CK

OSSEM/ASIM-like schemas

Education

BA/BS in CyberSecurity or related

Tools

SIGMA rules

CI/CD

Azure DevOps

Logic Apps

Azure Data Explorer

Kusto

Job description

LinkedIn seeks a senior individual contributor to design, build, and operate high-signal detections across endpoint, identity, cloud, and SaaS environments. You will use detections-as-code, telemetry modeling, and data-driven measurements to improve coverage and quality.

You will work with purple-team exercises, adversary emulation, and incident learnings while collaborating across security, engineering, and product teams.