Senior Threat Detection & Response Engineer

Talanto; San Francisco, Northern (CA, KY); Hybrid; USD 175,000 - 240,000; Full time

Benefits offered by this job

Equity

Benefits

Job summary

Talanto is seeking a Detection & Response engineer to build detection capabilities from the ground up for our enterprise environment. You will decide what to monitor, create telemetry pipelines, detection content, alert routing, and enrichment.

This zero-to-one role offers autonomy to shape the security program, working across IAM, NetEng, and IT Infrastructure Engineering to deliver effective detections and incident response.

Qualifications

• Deep hands-on experience in detection engineering, incident response, or security operations, with a track record of building capability.
• Depth in corporate attack surfaces such as identity providers and SSO, endpoint and EDR telemetry, email security, SaaS logs, device management signals, and corporate network access.
• Strong proficiency in Python and query language such as SQL.
• The ability to build and maintain detection-as-code pipelines yourself rather than specify them for someone else to build.
• Practical experience with SIEM, EDR, and security analytics platforms
• Investigative depth on endpoints and in cloud and SaaS environments, so you can reconstruct what happened across an IdP, a laptop, and a SaaS admin console, and say what you know versus what you're inferring.
• Excellent written communication and a collaborative approach to influence. You'll explain to engineers why a detection matters and to leadership what an incident actually means.
• Bonus points for experience as a founding security hire, insider threat or data loss detection, an offensive security background against corporate identity and endpoint paths, incident commander experience, endpoint or cloud forensics depth, or a clear view on what belongs in a SIEM versus a data warehouse.

Responsibilities

• Shape the technical direction for detection and response at the company. Define what good looks like, build the roadmap that gets us there, and make the case for the tooling and support it needs.
• Build detection engineering for the enterprise environment end to end. Telemetry pipelines, detection content, alert routing, and enrichment.
• Bring a threat-informed point of view. Track how adversaries operate against companies like ours and translate that into detections, hunts, and tabletop exercises that test whether we'd catch it.
• Own detections and data pipelines written as IaaC.
• Automate triage, enrichment, and response so alert volume can grow without a proportional increase in analyst time.
• Work with IAM, CPE, NetEng, and IT Infrastructure Engineering to get the telemetry you need.
• Partner with Enterprise Security to translate detection findings into control improvements, and hand root causes to the teams that own them with enough context that they actually get fixed.

Skills

Python

SQL

Detection engineering

Incident response

SIEM

EDR

Cloud forensics

Tools

SIEM

EDR

Security analytics platforms

Job description

Talanto is seeking a Detection & Response engineer to build detection capabilities from the ground up for our enterprise environment. You will decide what to monitor, create telemetry pipelines, detection content, alert routing, and enrichment.

This zero-to-one role offers autonomy to shape the security program, working across IAM, NetEng, and IT Infrastructure Engineering to deliver effective detections and incident response.