Senior Detection Engineer (EDR, Autonomous Defense)

Join our team as a Senior Detection Engineer, where you will be the blue team voice inside the Defensive Agent team. You will define what "correct" means in terms of attack technique detection and remediation. This role is not focused on coding or product management, but rather on owning the domain truth that both Product and Engineering depend on. You will partner with Product to turn EDR effectiveness and tuning ambitions into concrete requirements, define acceptance criteria for detection and effectiveness features, and serve as the standing domain reference for Engineering and AI research.

About Horizon3

6+ years in detection engineering, security operations, incident response, or threat hunting, with meaningful time spent as a practitioner rather than an advisor

Responsibilities

• Define what "correct" means in the context of detection engineering and remediation, and ensure that the product aligns with these standards.
• Translate blue team workflows and pain into prioritized product outcomes, and push back when a proposed feature or agent behavior would not hold up in a real SOC.
• Partner with Product to turn EDR effectiveness and tuning ambitions into concrete, buildable requirements, and validate releases against them before customers see them.
• Solid understanding of post-compromise attacker behavior and how each surfaces in endpoint and identity telemetry
• Hands-on operational experience administering and tuning EDR platforms in production — writing detections, managing policy and exclusions, and investigating real alerts
• Fluency in false positive and false negative tradeoffs, alert fatigue, and detection coverage measurement

Requirements

• Strong working knowledge of MITRE ATT&CK and detection coverage frameworks, and a clear view of where they help and where they mislead
• Deep understanding of what a SOC actually does with EDR output
• Ability to influence without authority. You will not manage the engineers or own the roadmap, and you will still be expected to move both
• Enough scripting ability, ideally Python, to query APIs, inspect telemetry, and prototype an analysis
• Demonstrated experience shaping a product or platform as a domain expert, whether in a security vendor, an internal tooling team, or a detection engineering function
• Comfort with SQL and with reasoning over large volumes of event and telemetry data
• Comfort translating between audiences: engineers, AI researchers, product managers, SOC analysts, and executives

Preferred

• Exceptional technical writing. Most of your leverage here comes from written artifacts — requirements, methodology docs, labeling guides, tuning content

Pay

USD 195,000 - 230,000