Threat Detection Engineer Jobs
Threat Detection Engineer jobs are open from entry-level to staff and principal across financial services, healthcare, government contracting, and cloud-native technology, with specializations in SIEM engineering, threat hunting, and behavioral analytics. Scan the live roles below and apply to whichever ones fit.
Find JobsLooking for remote work? View remote threat detection engineer jobs →Overview
Showing 5 of 40+ Threat Detection Engineer jobs
Security - San Francisco and US - Remote
About the team
OpenAI’s mission depends on developing and deploying powerful AI responsibly. Security makes that possible by protecting our research, people, products, and users while enabling progress. We defend sensitive research and other intellectual property, customer data, and the infrastructure behind frontier AI—from GPU supercomputing and multicloud environments to datacenters and emerging agent systems. Threat Detection Engineering builds and operates the detections and investigative workflows that turn adversary activity into effective response.
About the role
We’re looking for a hands-on technical leader to guide the engineers who identify and investigate threats to OpenAI and build the capabilities to contain them. You’ll hire and develop engineers, set technical direction, and prioritize risks to OpenAI’s intellectual property, customer data, and critical infrastructure.
Your team will take an agent-first approach across the detection and response lifecycle, using OpenAI’s models to develop detections, triage signals, investigate suspicious activity, and support bounded response and continuous improvement. You’ll turn advances in model capability into dependable defenses, own their effectiveness, and work with security, research, and infrastructure partners to ensure findings lead to effective action. You’ll establish where agents can act independently and where human judgment and approval are essential.
In this role, you will:
Hire, coach, and develop engineers. Set clear expectations, provide regular feedback, grow technical leadership, and build a team that reviews work rigorously and learns from missed detections and noisy signals.
Set a threat-informed roadmap. Prioritize detection work based on how external and internal actors could target the systems where we train and evaluate frontier models, the production services that run inference and power our products worldwide, the datacenter hardware and networks that support both, and the devices, identities, and applications employees rely on. Balance investment in emerging threats with closing known coverage gaps and keeping existing detections effective.
Own detection and investigation as a complete workflow. Embed agent-driven triage and investigation in the detections your team operates. Surface findings when the evidence points to a likely threat that warrants action. When a finding warrants formal incident response, bring the evidence to the Security Incident Response Team (SIRT) and support the investigation SIRT leads.
Build response and containment capabilities tailored to our infrastructure. Work with infrastructure and system owners to develop and test the controls responders need to contain threats in their environments. Define when human approval is required and how to verify that containment worked.
Apply models across the detection engineering lifecycle. Use OpenAI’s models to help develop threat hypotheses, author and test detections, deploy and tune them, and incorporate investigation findings into better coverage. Evaluate the effectiveness of individual agents and the complete workflows they support.
Turn model advances into tested defenses. Prototype new approaches using OpenAI’s models, evaluate them against realistic adversary behavior and analyst baselines, and move successful experiments into production. Use operational evidence to identify model limitations and partner with Research and Engineering to address them.
Anticipate emerging threats. Translate adversary intelligence and incident findings into testable detection hypotheses. Work with researchers and infrastructure owners on risks specific to a frontier AI lab, such as increasingly capable agents operating across systems with access to sensitive research. Determine what evidence would reveal compromise and what response would be effective.
Establish the visibility needed to detect, investigate, and respond. Partner with Security Observability and infrastructure owners to define telemetry and forensic data requirements. Drive improvements where missing evidence, unreliable data, or limited controls prevent the team from identifying threats or taking effective action.
Engineer for measurable security outcomes. Use replay, adversarial validation, and regression testing to assess whether workflows find intended threats, distinguish benign activity, and reach defensible conclusions. Establish code review, documentation, staged rollout, monitoring, and rollback practices. Measure coverage, investigation accuracy, time to identify threats, and effectiveness of response.
Contribute during incidents. The Security Incident Response Team (SIRT) leads formal incident response. Your team contributes investigative expertise and uses incident findings to improve detections.
You might thrive in this role if you:
Think like an adversary and demand evidence as a defender. You question whether apparent coverage would survive a determined attacker, distinguish plausible explanations from supported conclusions, and stay accountable for threats that existing tools and playbooks miss.
Have managed security or software engineers and can demonstrate how you have hired, coached, developed technical judgment, and improved a team’s ability to deliver.
Are a hands-on builder who can prototype tools, write and review code, and guide engineers through complex detection, investigation, and response designs.
Bring strong AI fluency and have built systems that test how models or agents can improve cyber defense. You have evaluated real security workflows against meaningful baselines and can explain what improved, what failed, and what you changed. You understand model failure modes and design reliable workflows with bounded permissions and clear human decision points.
Have built or operated threat detections and led technical investigations. You understand adversary tradecraft and can assess evidence, scope, and uncertainty across complex environments.
Understand how identity, endpoint, cloud, Kubernetes, and infrastructure telemetry supports investigations. You can reason about response and containment in unfamiliar systems and work with their owners to build practical capabilities.
Have used testing and operational feedback to improve security outcomes. You can explain tradeoffs among coverage, accuracy, speed, and human workload, and choose measures that reflect whether threats are being found and addressed.
Can build a focused roadmap and strong cross-functional partnerships in a rapidly changing environment. You enable researchers and engineers to move quickly while following through on security requirements and dependable operations.
About OpenAI
OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. We push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through our products. AI is an extremely powerful tool that must be created with safety and human needs at its core the full spectrum of humanity.
We are an equal opportunity employeration, or other applicable legally protected characteristic.
Background checks for applicants will be administered in accordance with applicable lawation technology systems and related data security obligations.
To notify OpenAI that you believe this job posting is non-compliant. No response will be provided to inquiries unrelated to job posting compliance.
We are committed to providing reasonable accommodations to applicants with disabilities.
At OpenAI, we believe artificial intelligence has the potential to help people solve immense global challenges, and we want the upside of AI to be widely shared. Join us in shaping the future of technology.
Compensation
$401K – $510K + Offers Equity
The base pay offered may vary depending on multiple individualized factorsance-related bonus(es) for eligible employees, and the following benefits.
Medical, dental, and vision insurance for you and your family, with employer contributions to Health Savings Accounts
Pre-tax accounts for Health FSA, Dependent Care FSA, and commuter expenses (parking and transit)
401(k) retirement plan with employer match
Paid parental leave (up to 24 weeks for birth parents and 20 weeks for non-birthing parents), plus paid medical and caregiver leave (up to 8 weeks)
Paid time off: flexible PTO for exempt employees and up to 15 days annually for non-exempt employees
13+ paid company holidays, and multiple paid coordinated company office closures throughout the year for focus and recharge, plus paid sick or safe time (1 hour per 30 hours worked, or more, as required by applicable state or local law)
Mental health and wellness support
Employer-paid basic life and disability coverage
Annual learning and development stipend to fuel your professional growth
Daily meals in our offices, and meal delivery credits as eligible
Relocation support for eligible employees
Additional taxable fringe benefits, such as charitable donation matching and wellness stipends, may also be provided.
More details about our benefits are available to candidates during the hiring process.
This role is at-will and OpenAI reserves the right to modify base pay and other compensation components at any time based on individual performance, team or company results, or market conditions.
Security - San Francisco and US - Remote
About the team
OpenAI’s mission depends on developing and deploying powerful AI responsibly. Security makes that possible by protecting our research, people, products, and users while enabling progress. We defend sensitive research and other intellectual property, customer data, and the infrastructure behind frontier AI—from GPU supercomputing and multicloud environments to datacenters and emerging agent systems. Threat Detection Engineering builds and operates the detections and investigative workflows that turn adversary activity into effective response.
About the role
We’re looking for a hands-on technical leader to guide the engineers who identify and investigate threats to OpenAI and build the capabilities to contain them. You’ll hire and develop engineers, set technical direction, and prioritize risks to OpenAI’s intellectual property, customer data, and critical infrastructure.
Your team will take an agent-first approach across the detection and response lifecycle, using OpenAI’s models to develop detections, triage signals, investigate suspicious activity, and support bounded response and continuous improvement. You’ll turn advances in model capability into dependable defenses, own their effectiveness, and work with security, research, and infrastructure partners to ensure findings lead to effective action. You’ll establish where agents can act independently and where human judgment and approval are essential.
In this role, you will:
Hire, coach, and develop engineers. Set clear expectations, provide regular feedback, grow technical leadership, and build a team that reviews work rigorously and learns from missed detections and noisy signals.
Set a threat-informed roadmap. Prioritize detection work based on how external and internal actors could target the systems where we train and evaluate frontier models, the production services that run inference and power our products worldwide, the datacenter hardware and networks that support both, and the devices, identities, and applications employees rely on. Balance investment in emerging threats with closing known coverage gaps and keeping existing detections effective.
Own detection and investigation as a complete workflow. Embed agent-driven triage and investigation in the detections your team operates. Surface findings when the evidence points to a likely threat that warrants action. When a finding warrants formal incident response, bring the evidence to the Security Incident Response Team (SIRT) and support the investigation SIRT leads.
Build response and containment capabilities tailored to our infrastructure. Work with infrastructure and system owners to develop and test the controls responders need to contain threats in their environments. Define when human approval is required and how to verify that containment worked.
Apply models across the detection engineering lifecycle. Use OpenAI’s models to help develop threat hypotheses, author and test detections, deploy and tune them, and incorporate investigation findings into better coverage. Evaluate the effectiveness of individual agents and the complete workflows they support.
Turn model advances into tested defenses. Prototype new approaches using OpenAI’s models, evaluate them against realistic adversary behavior and analyst baselines, and move successful experiments into production. Use operational evidence to identify model limitations and partner with Research and Engineering to address them.
Anticipate emerging threats. Translate adversary intelligence and incident findings into testable detection hypotheses. Work with researchers and infrastructure owners on risks specific to a frontier AI lab, such as increasingly capable agents operating across systems with access to sensitive research. Determine what evidence would reveal compromise and what response would be effective.
Establish the visibility needed to detect, investigate, and respond. Partner with Security Observability and infrastructure owners to define telemetry and forensic data requirements. Drive improvements where missing evidence, unreliable data, or limited controls prevent the team from identifying threats or taking effective action.
Engineer for measurable security outcomes. Use replay, adversarial validation, and regression testing to assess whether workflows find intended threats, distinguish benign activity, and reach defensible conclusions. Establish code review, documentation, staged rollout, monitoring, and rollback practices. Measure coverage, investigation accuracy, time to identify threats, and effectiveness of response.
Contribute during incidents. The Security Incident Response Team (SIRT) leads formal incident response. Your team contributes investigative expertise and uses incident findings to improve detections.
You might thrive in this role if you:
Think like an adversary and demand evidence as a defender. You question whether apparent coverage would survive a determined attacker, distinguish plausible explanations from supported conclusions, and stay accountable for threats that existing tools and playbooks miss.
Have managed security or software engineers and can demonstrate how you have hired, coached, developed technical judgment, and improved a team’s ability to deliver.
Are a hands-on builder who can prototype tools, write and review code, and guide engineers through complex detection, investigation, and response designs.
Bring strong AI fluency and have built systems that test how models or agents can improve cyber defense. You have evaluated real security workflows against meaningful baselines and can explain what improved, what failed, and what you changed. You understand model failure modes and design reliable workflows with bounded permissions and clear human decision points.
Have built or operated threat detections and led technical investigations. You understand adversary tradecraft and can assess evidence, scope, and uncertainty across complex environments.
Understand how identity, endpoint, cloud, Kubernetes, and infrastructure telemetry supports investigations. You can reason about response and containment in unfamiliar systems and work with their owners to build practical capabilities.
Have used testing and operational feedback to improve security outcomes. You can explain tradeoffs among coverage, accuracy, speed, and human workload, and choose measures that reflect whether threats are being found and addressed.
Can build a focused roadmap and strong cross-functional partnerships in a rapidly changing environment. You enable researchers and engineers to move quickly while following through on security requirements and dependable operations.
About OpenAI
OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. We push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through our products. AI is an extremely powerful tool that must be created with safety and human needs at its core the full spectrum of humanity.
We are an equal opportunity employeration, or other applicable legally protected characteristic.
Background checks for applicants will be administered in accordance with applicable lawation technology systems and related data security obligations.
To notify OpenAI that you believe this job posting is non-compliant. No response will be provided to inquiries unrelated to job posting compliance.
We are committed to providing reasonable accommodations to applicants with disabilities.
At OpenAI, we believe artificial intelligence has the potential to help people solve immense global challenges, and we want the upside of AI to be widely shared. Join us in shaping the future of technology.
Compensation
$401K – $510K + Offers Equity
The base pay offered may vary depending on multiple individualized factorsance-related bonus(es) for eligible employees, and the following benefits.
Medical, dental, and vision insurance for you and your family, with employer contributions to Health Savings Accounts
Pre-tax accounts for Health FSA, Dependent Care FSA, and commuter expenses (parking and transit)
401(k) retirement plan with employer match
Paid parental leave (up to 24 weeks for birth parents and 20 weeks for non-birthing parents), plus paid medical and caregiver leave (up to 8 weeks)
Paid time off: flexible PTO for exempt employees and up to 15 days annually for non-exempt employees
13+ paid company holidays, and multiple paid coordinated company office closures throughout the year for focus and recharge, plus paid sick or safe time (1 hour per 30 hours worked, or more, as required by applicable state or local law)
Mental health and wellness support
Employer-paid basic life and disability coverage
Annual learning and development stipend to fuel your professional growth
Daily meals in our offices, and meal delivery credits as eligible
Relocation support for eligible employees
Additional taxable fringe benefits, such as charitable donation matching and wellness stipends, may also be provided.
More details about our benefits are available to candidates during the hiring process.
This role is at-will and OpenAI reserves the right to modify base pay and other compensation components at any time based on individual performance, team or company results, or market conditions.
See All 40 Threat Detection Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsThreat Detection Engineer Job Market
Who's Hiring
Top Industries Hiring
- Retail
- Technology & Software
What Employers Look For
The qualifications that appear most often in threat detection engineer jobs.
- Three or more years of experience writing and tuning detection rules in a SIEM platform
- Hands-on proficiency with Splunk, Microsoft Sentinel, Elastic SIEM, or Chronicle
- Practical knowledge of the MITRE ATT&CK framework applied to real detection use cases
- Familiarity with scripting in Python or PowerShell for detection automation and log parsing
- Experience with endpoint detection tools such as CrowdStrike, SentinelOne, or Carbon Black
- Bachelor's degree in computer science, cybersecurity, or a related technical field
Tips for Your Threat Detection Engineer Job Search
Tailor your resume to detection engineering
Hiring managers scan for specific detection artifacts: custom SIEM rules, detection-as-code pipelines, and threat hunt playbooks. List the MITRE ATT&CK techniques you have written detections for and name the platforms, such as Splunk, Elastic, or Chronicle, by version where possible.
Certify before targeting government roles
Federal and defense contractor postings almost always require a DoD 8570 baseline certification, typically Security+ at minimum, and many ask for GCIA or GCIH. Check the clearance level in each posting before applying so you do not waste time on roles with hard prerequisites you cannot meet immediately.
Apply early to roles that fit
Migrate Mate lists threat detection engineer openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Show detection logic in a public repository
Attach a GitHub link that contains Sigma rules, Yara signatures, or detection-as-code you have written. Reviewers in this discipline read the logic itself, not just your job title, so runnable, documented detections do more than a bullet point claiming you have written them.
Prepare a structured walkaround of one real hunt
Interviewers for threat detection roles consistently ask you to walk through an investigation from hypothesis to detection to remediation. Prepare one concrete example with the data source, the anomaly you spotted, the query or rule you built, and the outcome, and rehearse it until it runs under three minutes.
Negotiate scope alongside compensation
Detection engineering teams vary enormously in whether you own the full detection lifecycle or just write rules someone else tunes. During offer conversations, clarify whether you will control rule logic end-to-end, have access to raw log sources, and can ship changes without a lengthy change-control process.
Threat Detection Engineer Jobs: Frequently Asked Questions
Which companies are hiring the most threat detection engineers?
The most active employers for threat detection engineers right now are Samsara, Apple, and SpaceX, and the most openings are in California, Ohio, and Texas, based on current listings on Migrate Mate as of November 2026. Financial services firms, cloud providers, and federal contractors consistently represent the largest share of open roles.
How many threat detection engineer jobs are remote?
About 83% of threat detection engineer openings are fully remote or hybrid as of November 2026, reflecting strong employer flexibility compared to many other security disciplines. Detection engineering work that centers on SIEM rule development and threat hunting tends to be the most remote-friendly, while roles tied to on-premises infrastructure or classified government networks typically require an on-site presence.
How do you become a threat detection engineer?
Start by building a foundation in security operations, ideally working in a SOC analyst role where you triage alerts and develop familiarity with log sources and attacker behavior. From there, deepen your SIEM skills by writing custom detection rules and mapping them to MITRE ATT&CK. Earning a certification such as GCIA, GCIH, or the Elastic Certified Analyst demonstrates detection-specific competency. Publishing Sigma rules or Yara signatures in a public repository accelerates your transition into dedicated detection engineering roles.
Can I get a threat detection engineer job with little experience?
Yes, but you need concrete detection artifacts to show instead of years of tenure. Build a home lab, ingest logs from an intentionally vulnerable environment, write Sigma rules for common attacker techniques, and publish the rules publicly. Associate-level SIEM certifications and a documented threat hunt report from your lab environment are more persuasive to hiring managers than unverified claims of experience.
What does the threat detection engineer interview process look like?
Most processes run three to four rounds. A recruiter screen is followed by a technical phone interview that tests SIEM query writing and ATT&CK knowledge. The core round is usually a live detection challenge where you are given sample logs and asked to write a detection rule or identify malicious activity. Final rounds often include a behavioral interview with the security leadership team and, for more senior roles, a short take-home detection design exercise.
Where can I find and apply to threat detection engineer jobs?
You can find and apply to threat detection engineer jobs on Migrate Mate, which lists current openings from across the United States. Search for roles that match your experience level and specialization, then apply directly to each listing that fits.
See All 40 Threat Detection Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs