Senior EDR Detection Domain Expert

AI Chopping Block; Northern (KY); Hybrid; USD 195,000 - 230,000; Full time

Benefits offered by this job

Inclusive Team

Growth Opportunities

Innovative Culture

Hybrid & Remote Work

Competitive Compensation

Job summary

Horizon3 is a fast-growing, remote cybersecurity company delivering autonomous pentests and detection capabilities through the NodeZero platform. We seek a Senior Detection Engineer to define what is “correct” for detections, sit between Product and Engineering, and own the domain truth used to measure outcomes.

You’ll partner with Product, guide SOC‑level tooling, and ensure robust detection coverage across EDR platforms, telemetry, and vendor guidance.

Qualifications

• 6+ years in detection engineering, security operations, incident response, or threat hunting.
• Hands-on experience administering and tuning EDR platforms in production.
• Deep understanding of SOC operations with EDR output.
• Fluency in false positives/negatives, alert fatigue, and detection coverage measurement.
• Strong knowledge of MITRE ATT&CK and detection frameworks.
• Understanding post‑compromise attacker behavior in endpoint telemetry.

Responsibilities

• Define acceptance criteria for detection, effectiveness, and tuning features and validate releases.
• Partner with Product to turn EDR concepts into concrete, buildable requirements.
• Serve as domain reference for Engineering and AI research and provide design guidance.
• Maintain fluency across tools, platforms, and vendor guidance to ensure consistent coverage.
• Collaborate with the Attack team to align detection coverage with adversary tradecraft.

Skills

Detection engineering

Security operations

Incident response

Threat hunting

MITRE ATT&CK

Endpoint telemetry

Python

SQL

Education

Bachelor's degree in cybersecurity or related field

Tools

EDR platforms

Job description

Horizon3 is a fast-growing, remote cybersecurity company delivering autonomous pentests and detection capabilities through the NodeZero platform. We seek a Senior Detection Engineer to define what is “correct” for detections, sit between Product and Engineering, and own the domain truth used to measure outcomes.

You’ll partner with Product, guide SOC‑level tooling, and ensure robust detection coverage across EDR platforms, telemetry, and vendor guidance.