Senior EDR Detection Architect – Autonomous Defense (Remote)

Openkrill; United States; Hybride; USD 195 000 - 230 000; Plein temps

Avantages offerts par ce poste

Equity options

Health, Vision & Dental insurance

Generous parental leave

Hybrid & Remote work

Résumé du poste

Horizon3 is seeking a Senior Detection Engineer to be the blue team voice inside the Autonomous Defense team. You will define what “correct” means for detection when an attack technique is detected, and decide what remediation is required.

This role sits between Product and Engineering with ownership of domain truth that informs build and measurement. The position emphasizes non-coding work, collaboration with product, engineering, and AI research, and requires hands-on experience tuning EDR

Qualifications

• 6+ years in detection engineering, security operations, incident response, or threat hunting.
• Hands‑on operational experience administering and tuning EDR platforms in production.
• Deep understanding of what a SOC actually does with EDR output.
• Fluency in false positive and false negative tradeoffs, alert fatigue, and detection coverage measurement.
• Strong working knowledge of MITRE ATT&CK and detection coverage frameworks.

Responsabilités

• Partner with Product to turn EDR effectiveness and tuning ambitions into concrete, buildable requirements.
• Translate blue team workflows and pain into prioritized product outcomes, and push back on unworkable features.
• Define acceptance criteria for detection, effectiveness, and tuning features, and validate releases before customers see them.
• Serve as the standing domain reference for Engineering and AI research: available for design reviews and technique questions.

Connaissances

6+ years in detection engineering

EDR tuning

MITRE ATT&CK

False positives tradeoffs

SOC operations

Outils

Python scripting

SQL

Description du poste

Horizon3 is seeking a Senior Detection Engineer to be the blue team voice inside the Autonomous Defense team. You will define what “correct” means for detection when an attack technique is detected, and decide what remediation is required.

This role sits between Product and Engineering with ownership of domain truth that informs build and measurement. The position emphasizes non-coding work, collaboration with product, engineering, and AI research, and requires hands-on experience tuning EDR