Senior Detection Engineer (EDR), Autonomous Defense
Horizon3 · Remote · US, Remote ·
COMPENSATION
€•• – ••k
Listed on the employer's job board (Ashby)
- Senior level role
- Fully remote option
- EDR & Blue Team focus
- Python & SQL fluency
- Equity package included
As the blue team voice within the Autonomous Defense team, you will define what correct detection and remediation look like for the NodeZero platform. You will translate SOC workflows into concrete product requirements and validate agent behavior against real-world adversary tradecraft.
This position focuses on domain expertise rather than coding or product management. You will serve as the ground truth for engineering and AI researchers, ensuring that detection logic, tuning, and policy semantics hold up in production environments.
What you'll do
- Partner with Product to convert EDR tuning goals into buildable technical requirements
- Define acceptance criteria for detection features and validate releases before launch
- Serve as the primary domain reference for Engineering and AI research teams
- Maintain deep knowledge of major EDR platforms at console, policy, and API levels
- Define vendor-specific policy semantics to ensure consistent cross-platform changes
- Track platform updates and keep coverage models current with vendor guidance
- Grade agent output against defined standards for correct tuning recommendations
- Collaborate with the Attack team to align detection expectations with adversary tradecraft
What you'll need
- 6+ years in detection engineering, SecOps, incident response, or threat hunting
- Hands-on experience administering and tuning EDR platforms in production
- Deep understanding of SOC workflows and how teams use EDR output
- Strong knowledge of MITRE ATT&CK and detection coverage frameworks
- Experience shaping products or platforms as a domain expert
- Ability to influence engineering and product teams without direct authority
- Exceptional technical writing skills for requirements and methodology docs
- Proficiency in Python for API queries and telemetry inspection
- Comfort with SQL and reasoning over large volumes of event data
Stack
- Python
- SQL
- EDR Platforms
- MITRE ATT&CK
- NodeZero
How you'll work
- Remote and hybrid work models available
- Chicago office available for roles requiring presence
- Flexible vacation policy
- Global team collaboration
What you get
- Base salary range $195,000-$230,000 annually
- Equity package in the form of stock options
- Health, vision, and dental insurance for family
- Generous parental leave
- Inclusive and collaborative culture