Senior Threat Detection Engineer — Remote

United States Digital Space LLC; United States; Remote; USD 196,000 - 207,000; Full time

Benefits offered by this job

Equity grant

Job summary

Instacart is seeking a Senior Detection Engineer II to own high‑fidelity detection logic across endpoint, cloud, container, and SaaS systems. You will hunt adversary techniques, improve coverage and scale, and collaborate with Engineering, Red Team, Incident Response, and Trust & Safety to reflect real-world behavior.

The role emphasizes detecting‑as‑code, reducing noise, and automating analyst workflows via SOAR.

Qualifications

• 6+ years in detection engineering, incident response, or offensive security.
• Experience with at least one public cloud platform (AWS/Azure/GCP).
• Deep understanding of attacker TTPs across zero trust environments.
• Proficient in macOS internals and telemetry for threats.
• Experience implementing detection-as-code workflows with version control, tests, and CI/CD.

Responsibilities

• Develop, tune, document, and maintain detection logic across endpoint, cloud, container, and SaaS sources.
• Assist in cyber forensic investigations across log sources.
• Optimize log ingestion pipelines and telemetry for high quality security data while managing volume and cost.
• Design and build SOAR playbooks and automation workflows for detection triage, enrichment, and response.
• Mentor junior analysts on threat hunting, detection logic development, and investigation techniques.

Skills

Detection engineering

Incident response

Offensive security

Public cloud platforms

macOS internals

Detection-as-code

Python / Golang

Security certifications

Job description

Instacart is seeking a Senior Detection Engineer II to own high‑fidelity detection logic across endpoint, cloud, container, and SaaS systems. You will hunt adversary techniques, improve coverage and scale, and collaborate with Engineering, Red Team, Incident Response, and Trust & Safety to reflect real-world behavior.

The role emphasizes detecting‑as‑code, reducing noise, and automating analyst workflows via SOAR.