Senior Threat Detection Engineer – Cloud & Forensics

EngineersOfAI; Northern (KY); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Instacart is seeking a Senior Detection Engineer II to lead high-fidelity detection logic across endpoint, cloud, container, and SaaS. You will partner with Engineering, Red Team, Incident Response, Fraud, and Trust & Safety to reflect real-world attacker behavior and reduce noise.

You will own the detection lifecycle with versioned, testable pipelines and contribute to scalable security coverage across multiple platforms."

Qualifications

• 6+ years in detection engineering, incident response, or offensive security.
• Experience with one or more public cloud platforms (AWS, Azure, GCP).
• Deep understanding of attacker TTPs across modern zero trust environments.
• Proficient understanding of macOS internals and related telemetry.
• Experience with detection-as-code workflows and CI/CD pipelines.
• Proficiency in Python, Golang, or equivalent languages.
• Relevant certifications such as GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar.

Responsibilities

• Develop, tune, document, and maintain detection logic across multiple log sources.
• Assist in cyber forensic investigations across various log sources.
• Optimize log ingestion pipelines and telemetry while managing volume and cost.
• Design and build SOAR playbooks and automation workflows.
• Mentor junior analysts and detection engineers on threat hunting and detection methods.

Skills

Detection engineering

Incident response

Cloud platforms

macOS internals

Detection-as-code

Python

Golang

CI/CD

SOAR/Automation

Tools

Git

Job description

Instacart is seeking a Senior Detection Engineer II to lead high-fidelity detection logic across endpoint, cloud, container, and SaaS. You will partner with Engineering, Red Team, Incident Response, Fraud, and Trust & Safety to reflect real-world attacker behavior and reduce noise.

You will own the detection lifecycle with versioned, testable pipelines and contribute to scalable security coverage across multiple platforms."