As a Detection Engineer, you'll be a technical anchor on the team: developing high-fidelity detection logic, hunting for novel attacker techniques, and raising the bar for how we think about coverage, quality, and scale. You'll work closely with Engineering, Red Team, Incident Response, Fraud, and Trust & Safety to ensure our detections reflect real-world adversary behavior (and not just signatures).
We operate with a detection-as-code mindset: everything we build is versioned, tested, and deployed through repeatable pipelines. We care deeply about reducing noise, improving analyst efficiency through automation and SOAR, and continuously evolving our coverage as the threat landscape shifts.
If you're energized by hard forensic problems, enjoy translating attacker TTPs into durable detection logic, and want to help shape the future of a growing security function, this role is for you.
About the Job
Develop, tune, document, and maintain detection logic across multiple log sources including endpoint, cloud, container, and SaaS products.
Assist in cyber forensic investigations across a variety of log sources
Optimize log ingestion pipelines and telemetry collection to ensure high-quality, actionable security data while managing volume and cost
Design and build SOAR playbooks and automation workflows to streamline detection triage, enrichment, and response actions
Mentor/knowledge share with other detection engineers on threat hunting methodologies, detection logic development, and investigation techniques
About You
Minimum Qualifications
2+ years of experience in a detection engineering, incident response, or offensive security role.
Experience with 1 or more public cloud platforms (AWS, Azure, GCP)
Deep understanding of attacker TTPs across modern zero trust environments, including identity compromise, token theft, and abuse of trust boundaries
Proficient understanding of macOS internals and telemetry available to identify macOS specific threats
Experience implementing detection-as-code workflows including version control, peer review processes, automated testing, and CI/CD deployment pipelines
Basic proficiency with Python, Golang, or other programming/scripting languages
Relevant certifications: GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar
Preferred Qualifications
Background in offensive security or red teaming
Knowledge of machine learning for threat detection
#LI-remote
Instacart provides highly market-competitive compensation and benefits in each location where our employees work. This role is remote and the base pay range for a successful candidate is dependent on their permanent work location. Please review our Flex First remote work policy here.
Offers may vary based on many factors, such as candidate experience and skills required for the role. Additionally, this role is eligible for a new hire equity grant as well as annual refresh grants. Please read more about our benefits offerings here.
For US based candidates, the base pay ranges for a successful candidate are listed below.
CA, NY, CT, NJ
$171,000—$180,500 USD
WA
$164,000—$173,000 USD
OR, DE, ME, MA, MD, NH, RI, VT, DC, PA, VA, CO, TX, IL, HI
$157,000—$165,500 USD
All other states
$142,000—$150,000 USD
