Senior Security Engineer, Detection & Response

Senior detection and response engineer at Flexport, working remotely in the US on a globally distributed security team with a follow-the-sun on-call rotation. There is no MSSP or tier-1 queue: engineers own their detections from writing through tuning to being paged.

The engineer builds detections across endpoint, identity, SaaS and cloud as version-controlled, peer-reviewed code, measures ATT&CK coverage, precision and time to detect, leads incident response through containment and retrospective, automates investigation toil, defines telemetry requirements for new systems before launch, and hunts proactively. Flexport wants about five to eight years in detection engineering, incident response or hunting, production detection work on a SIEM such as Panther, Elastic or Splunk, solid Python or Go, and hands-on incident handling.