Detection Engineer

Sygnia is the foremost global cyber readiness and response team, applying creative approaches and battle-tested solutions to help organizations beat attackers and stay secure. With a team of deep digital combat, leading-edge, purpose-built technology, and enterprise security specialists, it enables companies to proactively build cyber resilience and defeat attacks within their networks. Sygnia is a trusted advisor and service provider of technology and security teams, executives and boards of leading organizations worldwide. Sygnia supports clients at each stage of their security journey, bringing frontline experience and technological acumen to help them be unstoppable in the face of cyber threats. Learn more at Sygnia.co The company draws on top talent from the ranks of elite military technology units and from across the cyber industry, and has some of the world’s top talents in cyber security. Described by Forbes as a “cyber security delta force”, it applies technological supremacy, digital combat experience, data analytics and a business-driven mindset to cyber security, enabling organizations to excel in the age of cyber. The Detection Engineer is responsible for designing, validating, optimizing, and continuously improving Sygnia MDR detection content across multiple security domains. This role combines threat research, security analytics, data-driven decision making, and detection engineering to ensure high-fidelity threat detection while minimizing operational noise. The Detection Engineer serves as the bridge between MDR Operations, Product, Engineering, and Threat Research teams, transforming emerging threats, operational insights, and telemetry analysis into scalable and actionable detection capabilities. . Main Responsibilities: Detection Engineering & Optimization: Design, develop, maintain, and continuously optimize high-fidelity detection logic across endpoint, identity, cloud, email, network, and other security domains, maximizing coverage while minimizing false positives. Threat Research & Detection Coverage: Research emerging threats, vulnerabilities, and attacker TTPs, translating threat intelligence into actionable detections while identifying and closing gaps in MITRE ATT&CK and ATLAS coverage. Detection Quality & Performance: Establish detection quality standards, define and monitor performance metrics (precision, false positive rates, alert volume, coverage, and stability), and continuously improve detection effectiveness. Detection Testing & Validation: Develop testing methodologies, validation frameworks, and lab environments to evaluate detection logic through attack simulations, real-world scenarios, and repeatable testing procedures before production deployment. Security Data Research & Analytics: Analyze security telemetry, identify data quality and visibility gaps, and collaborate with Product and Engineering teams to improve data collection, normalization, enrichment, and detection capabilities. AI & Detection Innovation: Research, develop, and evaluate AI agents and AI-powered automation solutions for threat research, security investigations, detection engineering, and alert enrichment, ensuring measurable improvements in detection quality and operational efficiency. Detection Troubleshooting & Continuous Improvement: Investigate noisy or ineffective detections, perform root cause analysis, refine detection logic, and leverage operational feedback to improve alert quality and reduce analyst workload. Client-Specific Detection Development: Design and implement customized detection content based on client environments, security requirements, threat profiles, and available telemetry. Operational Excellence & Strategic Development: Drive initiatives to reduce alert fatigue, accelerate detection tuning, improve analyst efficiency, expand security visibility, and contribute to the long-term detection engineering strategy. Main Requirements: 3+ years of experience in Detection Engineering, Threat Hunting, Security Analytics, MDR, Security Research, or related cybersecurity roles. Experience delivering security detections for products, including hands-on experience creating, implementing, and tuning detection rules in SIEM, XDR, or EDR platforms. Experience working with large-scale security datasets and telemetry. Experience with SQL, KQL, Python, or similar analytical tools. Understanding of security monitoring, detection methodologies, and investigation workflows. Strong understanding of attacker TTPs and the MITRE ATT&CK and ATLAS framework. Experience developing AI agents or AI-powered automation solutions. Strong analytical mindset with the ability to explore, understand, and derive insights from large-scale security datasets. Experience working with security telemetry across multiple domains, including endpoint, identity, cloud, email, network security, OS internals, EDR, Active Directory, Office 365, Cloud technologies such as AWS, Microsoft Azure and GCP, Network protocols and security products, including experience with security of AI infrastructure and services. Ability to assess data quality, identify telemetry gaps, and evaluate the feasibility and effectiveness of detection strategies. Experience evaluating or onboarding new security data sources and telemetry. Excellent written and verbal communication skills. Passion for cybersecurity and continuous learning. Lab building and attack simulation experience. Threat Hunting experience, including hands-on IR experience – advantage. Red Team or penetration testing background – advantage Experience with Detection-as-Code methodologies, including Git-based workflows, version control, automated detection testing, and CI/CD pipelines – An advantage.