Senior Endpoint Detection Engineer — Remote, Equity Eligible

horizon3ai; United States; Hybrid; USD 150,000 - 190,000; Full time

Benefits offered by this job

Equity eligibility

Health, vision, and dental coverage

Flexible vacation

Parental leave

Job summary

horizon3ai is seeking a senior role providing blue-team domain authority for endpoint detection and response. You will translate operational security expertise into measurable product requirements, define acceptance criteria, and validate releases with cross-functional teams.

The role emphasizes judgment and domain ownership over software implementation, with strong collaboration across product, engineering, and AI research to align with SOC workflows and real-world usage.

Qualifications

• Six+ years in detection engineering, security operations, incident response, or threat hunting.
• Hands-on experience administering and tuning EDR platforms and policies.
• Deep understanding of SOC workflows, alert fatigue and tradeoffs.
• Strong knowledge of MITRE ATT&CK and practical limitations.
• Ability to translate operational expertise into clear requirements and criteria.

Responsibilities

• Translate detection goals into practical product requirements and outcomes.
• Define acceptance criteria for detection, prevention, and tuning; validate releases.
• Serve as domain reference during design reviews and vendor analyses.
• Maintain knowledge of major endpoint platforms, telemetries, and policies.
• Document vendor policy semantics for cross-product accuracy.
• Track platform changes and vendor guidance to keep coverage current.
• Define tuning standards and evaluate agent output with attack-focused teams.

Skills

Detection engineering

Security operations

Incident response

Threat hunting

SOC workflows

MITRE ATT&CK knowledge

Operational requirements to product

Communication and collaboration

Tools

EDR platforms

Job description

horizon3ai is seeking a senior role providing blue-team domain authority for endpoint detection and response. You will translate operational security expertise into measurable product requirements, define acceptance criteria, and validate releases with cross-functional teams.

The role emphasizes judgment and domain ownership over software implementation, with strong collaboration across product, engineering, and AI research to align with SOC workflows and real-world usage.