Detection Engineer Jobs
Detection Engineer jobs are open across financial services, healthcare, government, and technology, from junior analyst to senior and principal levels, with specializations in threat detection, SIEM engineering, and security automation. See the openings below and apply to the ones that match your experience.
Find Detection Engineer JobsLooking for remote work? View remote detection engineer jobs →Overview
Showing 5 of 119+ Detection Engineer jobs
Minimum qualifications:
- Bachelor's degree or equivalent practical experience.
- 2 years of experience with security engineering, computer and network security and security protocols.
- 2 years of experience with security assessments or security design reviews or threat modeling.
- 2 years of coding experience in one or more general purpose languages.
- Experience utilizing Agentic AI frameworks or developer kits to build and deploy autonomous AI systems.
- Experience in a technical security role (e.g., security engineering, security research, DevSecOps, incident response, SOC analyst, incident response, malware research, threat analysis).
Preferred qualifications:
- 5 years of experience in security engineering, detection engineering, incident response, or threat hunting.
- Experience investigating security events across Linux, containerized or sandboxed environments, cloud infrastructure, or corporate endpoints.
- Experience building or tuning behavioral detections, LLM-based evaluators, or multi-agent workflows, and measuring detection effectiveness.
- Experience operating in an on-call capacity, managing security escalations, and working with cross-functional teams.
- Experience with internal security, data, or AI ecosystems.
- Knowledge of frontier AI and agentic security risks, sandbox escape, prompt injection, or training environment tampering.
About the job
Our Security team works to create and maintain the safest operating environment for Google's users and developers. Security Engineers work with network equipment and actively monitor our systems for attacks and intrusions. In this role, you will also work with software engineers to proactively identify and fix security flaws and vulnerabilities.
As a Security Engineer on DeepMind Agentic Detection and Response in New York, you will be at the intersection of security operations, trajectory forensics, and AI-powered detection engineering. Because autonomous agents operate at machine speed, we practice "agent-first" defense: our automated pipelines and multi-agent workflows absorb Tier-1 volume and trigger containments, freeing our engineers to manage high-ambiguity investigations, hunt for novel agentic behaviors, and build the detections and agentic tooling that keep pace with rapidly evolving frontier models.
In this role, you will have a true operational and engineering split in a fast-moving, 0-to-1 environment where models, agent harnesses, sandboxes, and telemetry evolve weekly. Because operational security is core to safeguarding continuous frontier training and evaluation runs, this position includes rotational on-call support, including weekday daytime triage and periodic weekend on-call coverage. You might reconstruct multi-step Chain-of-Thought and tool-call trajectories to determine whether an anomaly is benign specification gaming or a real sandbox escape, coordinate live containment and blast-radius scoping between DeepMind teams and PSS Detection and Response, and build new AI agent skills, detection rubrics, or automated forensic pipelines in Python and SQL. You will deliver substantial technical and investigative contributions across interconnected components with minimal assistance, owning scoped end-to-end investigations, detections, and engineering artifacts, and codifying every catch into durable guardrails.
US: $147000 - $210000 (USD) + 15% bonus target + equity + benefits
Learn more about benefits at Google.
Responsibilities
- Reconstruct multi-step Chain-of-Thought (CoT) and tool-call trajectories to determine if anomalies are benign specification gaming or sandbox escapes.
- Coordinate live containment and blast-radius scoping between DeepMind teams and PSS Detection and Response.
- Build new AI agent skills, detection rubrics, and automated forensic pipelines using Python and SQL.
- Investigate high-ambiguity security events and hunt for novel agentic behaviors across frontier models.
- Develop detections and agentic security tooling to keep pace with rapidly evolving frontier models.
Minimum qualifications:
- Bachelor's degree or equivalent practical experience.
- 2 years of experience with security engineering, computer and network security and security protocols.
- 2 years of experience with security assessments or security design reviews or threat modeling.
- 2 years of coding experience in one or more general purpose languages.
- Experience utilizing Agentic AI frameworks or developer kits to build and deploy autonomous AI systems.
- Experience in a technical security role (e.g., security engineering, security research, DevSecOps, incident response, SOC analyst, incident response, malware research, threat analysis).
Preferred qualifications:
- 5 years of experience in security engineering, detection engineering, incident response, or threat hunting.
- Experience investigating security events across Linux, containerized or sandboxed environments, cloud infrastructure, or corporate endpoints.
- Experience building or tuning behavioral detections, LLM-based evaluators, or multi-agent workflows, and measuring detection effectiveness.
- Experience operating in an on-call capacity, managing security escalations, and working with cross-functional teams.
- Experience with internal security, data, or AI ecosystems.
- Knowledge of frontier AI and agentic security risks, sandbox escape, prompt injection, or training environment tampering.
About the job
Our Security team works to create and maintain the safest operating environment for Google's users and developers. Security Engineers work with network equipment and actively monitor our systems for attacks and intrusions. In this role, you will also work with software engineers to proactively identify and fix security flaws and vulnerabilities.
As a Security Engineer on DeepMind Agentic Detection and Response in New York, you will be at the intersection of security operations, trajectory forensics, and AI-powered detection engineering. Because autonomous agents operate at machine speed, we practice "agent-first" defense: our automated pipelines and multi-agent workflows absorb Tier-1 volume and trigger containments, freeing our engineers to manage high-ambiguity investigations, hunt for novel agentic behaviors, and build the detections and agentic tooling that keep pace with rapidly evolving frontier models.
In this role, you will have a true operational and engineering split in a fast-moving, 0-to-1 environment where models, agent harnesses, sandboxes, and telemetry evolve weekly. Because operational security is core to safeguarding continuous frontier training and evaluation runs, this position includes rotational on-call support, including weekday daytime triage and periodic weekend on-call coverage. You might reconstruct multi-step Chain-of-Thought and tool-call trajectories to determine whether an anomaly is benign specification gaming or a real sandbox escape, coordinate live containment and blast-radius scoping between DeepMind teams and PSS Detection and Response, and build new AI agent skills, detection rubrics, or automated forensic pipelines in Python and SQL. You will deliver substantial technical and investigative contributions across interconnected components with minimal assistance, owning scoped end-to-end investigations, detections, and engineering artifacts, and codifying every catch into durable guardrails.
US: $147000 - $210000 (USD) + 15% bonus target + equity + benefits
Learn more about benefits at Google.
Responsibilities
- Reconstruct multi-step Chain-of-Thought (CoT) and tool-call trajectories to determine if anomalies are benign specification gaming or sandbox escapes.
- Coordinate live containment and blast-radius scoping between DeepMind teams and PSS Detection and Response.
- Build new AI agent skills, detection rubrics, and automated forensic pipelines using Python and SQL.
- Investigate high-ambiguity security events and hunt for novel agentic behaviors across frontier models.
- Develop detections and agentic security tooling to keep pace with rapidly evolving frontier models.
Detection Engineer Jobs by Experience Level
See All 119+ Detection Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find Detection Engineer JobsDetection Engineer Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Retail
- Electronics & Hardware
What Employers Look For
The qualifications that appear most often in detection engineer jobs.
- Three or more years of experience writing and tuning detection rules in a SIEM platform
- Proficiency with at least one major SIEM such as Splunk, Microsoft Sentinel, Elastic, or Chronicle
- Hands-on knowledge of MITRE ATT&CK framework for mapping detections to adversary techniques
- Experience with scripting languages such as Python, PowerShell, or KQL for automation and log parsing
- Familiarity with endpoint, network, and cloud log sources including EDR, firewall, and cloud audit logs
- Security Operations Center or incident response background demonstrating alert triage and investigation skills
Tips for Your Detection Engineer Job Search
Tailor your resume to detection logic
List the detection rules, correlation queries, or behavioral analytics you've written, not just the platforms you've used. Hiring managers want to see that you've authored detections, tuned out false positives, and measured coverage against frameworks like MITRE ATT&CK.
Apply early to roles that fit
Migrate Mate lists detection engineer openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Map your experience to ATT&CK tactics
Job postings for detection engineers increasingly reference ATT&CK coverage and gap analysis. Annotate your resume and portfolio with the specific tactics and techniques your detections addressed, so reviewers immediately see how your work maps to their threat model.
Target postings by SIEM platform match
Detection engineering is tightly coupled to the SIEM or data platform in use. Filter openings by the tool you know best, whether Splunk, Microsoft Sentinel, Elastic, or Chronicle, since platform fluency is often a hard filter before the first screen.
Prepare a detection walkthrough for interviews
Most detection engineer technical screens ask you to build or critique a detection rule live. Practice explaining your logic out loud: what log source you'd use, what normal behavior looks like, what threshold you'd set, and how you'd reduce noise without missing true positives.
Negotiate scope, not just compensation
When evaluating offers, ask about the detection backlog, alert volume per analyst, and whether the team has dedicated time for detection development vs. triage. A role with strong tooling but no space to build detections limits your growth faster than a lower title would.
Detection Engineer Jobs: Frequently Asked Questions
Which companies are hiring the most detection engineers?
CrowdStrike, Google, and Samsara are hiring the most detection engineers right now, with openings concentrated in California, New York, and Virginia, based on current listings on Migrate Mate as of November 2026. Demand is highest at financial institutions, cloud providers, and managed security service providers.
How many detection engineer jobs are remote?
About 84% of detection engineer openings are fully remote or hybrid as of November 2026, reflecting strong employer flexibility in this discipline. Detection content development and SIEM tuning roles tend to be the most remote-friendly, while positions tied to classified environments or on-premises SOC operations are more likely to require on-site presence.
How do you become a detection engineer?
Start by building a foundation in security operations, specifically alert triage and incident response, so you understand what makes a detection actionable. Learn a major SIEM platform deeply, practice writing detection rules against real log data, and study the MITRE ATT&CK framework to understand adversary behavior. Building a personal lab to simulate attacks and develop detections is one of the most effective ways to demonstrate readiness to employers.
Can you get hired as a detection engineer without direct experience?
You can transition into detection engineering from adjacent roles like SOC analyst, incident responder, or threat intelligence analyst. Employers often accept candidates who can show hands-on detection work from a home lab, open-source contributions, or CTF participation. Earning a Splunk Core Certified User, Microsoft SC-200, or Elastic Certified Analyst credential also signals platform readiness when formal job history is limited.
What does the detection engineer interview process look like?
Most detection engineer interviews include a recruiter screen, a hiring manager conversation focused on your detection development approach, and a technical assessment where you write or critique a detection rule against a provided log sample or attack scenario. Some employers add a final panel covering threat modeling and cross-team collaboration. Expect questions about false positive management, MITRE ATT&CK coverage gaps, and how you measure detection quality.
Where can I find and apply to detection engineer jobs?
You can find and apply to detection engineer jobs on Migrate Mate, which lists current openings from across the United States. Search the listings to find roles that match your experience level, platform background, and preferred work arrangement, then apply directly to each one that fits.
See All 119+ Detection Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find Detection Engineer Jobs