Staff Detection Engineer - Remote/Hybrid Leader

LinkedIn; Mountain View (CA); Hybrid; USD 156,000 - 255,000; Full time

Job summary

LinkedIn’s Detection Engineering team seeks a Staff Security Engineer to define and drive LinkedIn’s detection strategy across endpoint, identity, cloud, and SaaS environments.

You will architect, build, and operate high-signal detection capabilities using modern detections-as-code practices, telemetry modeling, and data-driven effectiveness measures, including precision, recall, signal-noise ratio, and detection latency.

Qualifications

• BA/BS in CyberSecurity, Information Security, Computer Science or related technical discipline, or related practical experience.
• 5+ years in security engineering, detection engineering, or incident response
• 2+ years technical leadership.
• Expertise with log analytics and detection content for SIEM/XDR/EDR and cloud provider telemetry (AWS/Azure/GCP).
• Experience building detections and automation with scripting languages (e.g., Python) and query languages (e.g., KQL/SQL)
• Experience building detections-as-code (tests, CI/CD, canary deploys, rollback) at large scale.
• Experience with attacker TTPs and frameworks (ATT&CK) and detection efficacy metrics.
• Experience designing schemas and data models (e.g., ASIM/OSSEM-like) and telemetry pipelines.
• Experience with SIGMA rule authoring and translation; adversary emulation/purple-team experience.

Responsibilities

• Define detection strategy and roadmap; drive coverage across priority threat scenarios and emerging attacks relevant to LinkedIn
• Partner with IR/Threat Intel/Cloud/IAM to turn hypotheses and TTPs into production detections; lead purple-team validation.
• Design detections-as-code with version control, CI/CD, unit/integration tests, and staged rollouts.
• Lead adversary emulation exercises to validate detection coverage; develop synthetic signal and test harnesses.
• Proactive threat hunting to discover unknown attacker activity; design hunt playbooks and convert findings into detections.
• Build IR automation (SOAR/Logic Apps) to orchestrate triage, enrichment, containment, and case workflow.
• Operationalize threat intelligence: ingest/normalize IOCs/TTPs, enrich detections with TI context, and collaborate with TI to turn reports into testable hypotheses.
• Build and maintain a SIGMA-based detection content library; translate SIGMA to KQL/SQL where applicable.
• Own telemetry quality: schemas, enrichment, normalization, and data reliability SLIs/SLOs.
• Establish and monitor detection quality metrics (signal-to-noise ratio, precision/recall, false-positive rate, alert latency, lift); drive continuous tuning.
• Lead incident retros to add resilient post-incident detections and suppress noisy patterns.
• Mentor engineers; establish standards, code reviews, and guidance for detection engineering best practices.
• Participate in on-call for critical detection pipelines and high-severity investigations.

Skills

Detection Engineering

Technical Leadership

KQL/SQL

Detection-as-code

Threat Hunting

Mentoring Engineers

ATT&CK/TTPs

SIGMA rules

Education

Bachelor's degree in CyberSecurity/CS

MS/PhD in related field

Tools

SIEM/XDR/EDR

Cloud telemetry (AWS/Azure/GCP)

SIGMA

Job description

LinkedIn’s Detection Engineering team seeks a Staff Security Engineer to define and drive LinkedIn’s detection strategy across endpoint, identity, cloud, and SaaS environments.

You will architect, build, and operate high-signal detection capabilities using modern detections-as-code practices, telemetry modeling, and data-driven effectiveness measures, including precision, recall, signal-noise ratio, and detection latency.