Detection Engineer - Product Security (For independent contractors)

About the role

Join Product Security to build and improve how we detect and respond to threats across our web and mobile applications, APIs, and supporting services. You will develop SIEM detections, improve the telemetry behind them, strengthen AI-agent-assisted alert triage, and build carefully controlled response automation.

What you’ll do

• Build, test, and tune security detections and anomaly-detection jobs in a SIEM. Use version control, backtesting, and staged releases to keep detections reliable.

  
  

• Develop coverage for threats such as account takeover, automated abuse, unusual traffic, enumeration, access-control failures, authentication and session misuse, and suspicious access to sensitive data.

  
  

• Identify the application events and fields needed for effective detection. Work with application and platform teams to improve event coverage, quality, and attribution.

  
  

• Design, build, and improve the AI triage agent itself. Develop its workflows, tool integrations, context enrichment, and escalation behavior; measure decision quality, reduce noise, and ensure uncertain or high-impact cases reach a human responder.

  
  

• Build incident workflows and response playbooks that enrich alerts, route them to the right responders, and provide clear investigation guidance.

  
  

• Introduce response automation in stages. Test actions, limit their scope, and provide appropriate human approvals, audit records, monitoring, and rollback.

  
  

• Evaluate detection and response performance, investigate failures, and use responder feedback to improve the system.

What you’ll bring

• Experience building or operating production software or security systems.

  
  

• Practical experience with SIEM queries, security analytics, detection development, or alert tuning.

  
  

• Knowledge of web, mobile, or API security threats and how to detect them in application and security data.

  
  

• Ability to write maintainable code and automation in a language such as Python, Go, or Java.

  
  

• Hands-on experience building, integrating, or extending AI agents or LLM-powered applications, including tool integrations, orchestration, evaluation, and safety controls.

  
  

• Understanding of logging, event schemas, data quality, and how telemetry gaps affect security detection.

  
  

• Experience testing and deploying automation safely, including access control, auditability, failure handling, and rollback.

  
  

• Clear communication and the ability to work with security, application, and platform teams.

  Helpful experience

  
  

• Behavioral analytics, anomaly detection, or machine-learning systems.

  
  

• Agent frameworks, tool-calling workflows, retrieval and context enrichment, and LLM evaluation.

  
  

• Security orchestration, incident response, or containment playbooks.

  
  

• Web and mobile application security testing or investigation.

  
  

• Infrastructure as code and CI/CD practices.