Senior Detection & Response Engineer — End-to-End Detections

Flexport; Los Angeles (CA); On-site; USD 138,000 - 252,000; Full time

Job summary

At Flexport, Detection & Response engineers own detections end to end—from writing and tuning to being paged when they fire. You will define telemetry, hunt threats, and build automation to reduce toil, across global teams and time zones.

Typical candidates have 5–8 years in detection engineering or incident response, strong Python/Go skills, and hands-on experience with modern SIEMs (Panther/Elastic/Splunk). The role emphasizes end-to-end ownership and impactful security outcomes.

Qualifications

• Typically 5–8 years of experience in detection engineering, incident response, or threat hunting, with hands-on experience building and tuning detections.
• Proficiency in at least one programming language (Python, Go, or similar) and ability to write production-grade detection/automation code.
• Experience with a modern SIEM or detection pipeline (Panther, Elastic, Splunk, or similar).
• Practical incident response experience: led or played a major role in triaging and closing real incidents.

Responsibilities

• Build and tune detections across endpoint, identity, SaaS, and cloud as part of CI/CD.
• Own incident response: triage, containment, remediation, and retrospectives to drive systemic fixes.
• Define telemetry requirements for new systems and ensure visibility gaps are closed.
• Threat hunt proactively across the estate and convert hypotheses into detections or coverage.

Skills

Detection engineering

Incident response

Threat hunting

Python/Go

CI/CD

Tools

Panther

Elastic

Splunk

Job description

At Flexport, Detection & Response engineers own detections end to end—from writing and tuning to being paged when they fire. You will define telemetry, hunt threats, and build automation to reduce toil, across global teams and time zones.

Typical candidates have 5–8 years in detection engineering or incident response, strong Python/Go skills, and hands-on experience with modern SIEMs (Panther/Elastic/Splunk). The role emphasizes end-to-end ownership and impactful security outcomes.