Senior Security Engineer, Detection Engineering

RemoteSeniorPosted Aug 17, 2026

SplunkPythonSQLKubernetesCI/CD+25 more

About this role

NVIDIA Security is seeking a Senior Detection Engineer to build reliable detection coverage across enterprise, cloud, AI, and production environments. You'll turn sophisticated security signals into high-confidence detections, reduce noise for responders, and drive detection-as-code workflows. The role involves close collaboration with incident response, threat intelligence, and engineering teams.

Must have

8+ years of experience in detection engineering, security engineering, threat hunting, incident response, SOC engineering, or information security monitoring

A degree in Computer Science, Cybersecurity, Engineering, or equivalent experience

Hands-on experience building and tuning detections in a major SIEM or security analytics platform

Strong query and scripting skills, especially SPL, KQL, SQL, Python, or similar languages used to analyze security telemetry and automate repetitive work

Practical understanding of attacker behavior across identity, endpoint, cloud, network, email, collaboration tools, developer infrastructure, secrets, and data theft

Ability to move from raw logs to a production-ready detection, including field semantics, thresholds, joins, baselines, false positives, missing data, and triage context

Comfortable working with Git, code review, automated checks, CI/CD, documentation, and operational ownership of the content you ship

Clear communication and sound judgment to explain why a detection matters, what it misses, and when to choose not to alert

Technologies

PythonSQLAWSAzureGitDockerRESTLinuxJiraTerraformTestingMicrosoftCloudGitLabJSONData engineeringCybersecurityAISplunkAutomationKubernetesCI/CDKQLSPLCrowdStrikeSIEMThreat intelligenceEndpoint securityIdentity managementNetwork security

Responsibilities

Build and tune high-confidence detections across platforms such as Splunk, Microsoft Sentinel / Defender, CrowdStrike, cloud-native logs, identity telemetry, endpoint data, SaaS platforms, and developer systems

Translate incidents, hunts, threat intelligence, red-team findings, and vulnerability context into detection logic we can test and operate

Investigate real telemetry before we alert on it, including field behavior, timing, joins, baselines, and the false positives a responder will actually see

Drive the full detection lifecycle: design, query development, validation, peer review, documentation, deployment, tuning, monitoring, and retirement

Strengthen detection-as-code workflows, including test data, quality checks, metadata, rollout safety, coverage tracking, and detection health reporting

Partner with responders to cut noise, add useful context, improve severity decisions, and build follow-up detections after investigations

Shape logging, normalization, enrichment, and retention requirements when the telemetry we need is missing or hard to use

Coach analysts and engineers through design reviews, query reviews, and clear guidance on what makes a detection credible

Benefits

EquityTraining and career developmentPaid parental leaveHealth insuranceDental insuranceVision insuranceRetirement benefits with matchWellness platform with incentivesCompetitive salary and stock option planFlexible PTO