Senior Security Engineer, Detection Engineering

RemoteSeniorPosted Aug 17, 2026

SplunkMicrosoft SentinelCrowdStrikePythonKQLSPLKubernetesDetection-as-code+8 more

About this role

NVIDIA Security is seeking a Senior Detection Engineer to build reliable detection coverage across enterprise, cloud, AI, and production environments. You'll turn security signals into high-confidence detections, reduce noise, and protect NVIDIA's diverse infrastructure while working closely with incident response, threat intelligence, and engineering teams.

Must have

8+ years of experience in detection engineering, security engineering, threat hunting, incident response, SOC engineering, or information security monitoring

A degree in Computer Science, Cybersecurity, Engineering, or equivalent experience

Hands-on experience building and tuning detections in a major SIEM or security analytics platform

Strong query and scripting skills, especially SPL, KQL, SQL, Python, or similar languages used to analyze security telemetry and automate repetitive work

Practical understanding of attacker behavior across identity, endpoint, cloud, network, email, collaboration tools, developer infrastructure, secrets, and data theft

Ability to move from raw logs to a production-ready detection, including field semantics, thresholds, joins, baselines, false positives, missing data, and triage context

Comfortable working with Git, code review, automated checks, CI/CD, documentation, and operational ownership of the content you ship

Clear communication and sound judgment to explain why a detection matters, what it misses, what to do next, and when not to alert

Technologies

PythonSQLGitSplunkKubernetesCI/CDKQLSPLCrowdStrikeSIEMThreat intelligenceEndpoint securityIdentity managementCloud securityDetection-as-codeMicrosoft Sentinel

Responsibilities

Build and tune high-confidence detections across platforms such as Splunk, Microsoft Sentinel, Defender, CrowdStrike, cloud-native logs, identity telemetry, endpoint data, SaaS platforms, and developer systems

Translate incidents, hunts, threat intelligence, red-team findings, and vulnerability context into detection logic we can test and operate

Investigate real telemetry before alerting on it, including field behavior, timing, joins, baselines, and false positives a responder will actually see

Drive the full detection lifecycle: design, query development, validation, peer review, documentation, deployment, tuning, monitoring, and retirement

Strengthen detection-as-code workflows, including test data, quality checks, metadata, rollout safety, coverage tracking, and detection health reporting

Partner with responders to cut noise, add useful context, improve severity decisions, and build follow-up detections after investigations

Shape logging, normalization, enrichment, and retention requirements when needed telemetry is missing or hard to use

Coach analysts and engineers through design reviews, query reviews, and clear guidance on what makes a detection credible