Detection Engineer - REMOTE

Binary Defense is seeking an experienced and motivated Detection Engineer to join our growing Detection Engineering team. You’ll be a hands-on contributor, responsible for building, deploying, and maintaining high-quality detections across a variety of platforms, including SIEMs, EDRs, and cloud environments.

Our team operates detection engineering as code, and we are looking for someone who thrives in a modern, automation-driven environment. You should have a strong grasp of threat modeling, detection choke points, and the ability to abstract away UI dependencies using Python and REST APIs. This is an opportunity to contribute to a mature detection pipeline focused on coverage, efficacy, and scalability.

Responsibilities

· Design and implement detections using a detection-as-code approach across SIEM (e.g., Splunk, Sentinel, Chronicle) and EDR platforms (e.g., CrowdStrike, Cortex XDR, SentinelOne).

· Develop and operationalize detection logic in YAML/Sigma/YARA-L, including documentation, tuning, testing, and version control.

· Leverage APIs to automate rule deployment, validation, and telemetry inspection—reducing reliance on GUIs.

· Collaborate with Threat Intel, Incident Response, and Cloud Security teams to create threat-informed detections based on real-world attack behaviors.

· Contribute to threat modeling efforts to identify high-value detection opportunities and coverage gaps.

· Analyze telemetry sources (e.g., Windows Event Logs, Sysmon, cloud logs, network traffic) to identify detection use cases and ensure telemetry readiness.

· Participate in adversary simulation and detection validation efforts using tools such as Atomic Red Team, Caldera, or custom scripting.

· Support documentation of detection logic, coverage rationale, and response guidance.

· Actively contribute to continuous improvement of detection engineering workflows, tooling, and standards.