Detection Engineer II

Role Overview

Instacart’s Detection Engineering team (within Security) builds and operates systems that identify, surface, and respond to threats across endpoint, cloud, container, and SaaS. As a Detection Engineer II, you’ll act as a technical anchor for detection coverage—translating attacker TTPs into high-fidelity detections and improving quality, scale, and analyst efficiency.

Responsibilities

• Develop, tune, document, and maintain detection logic across multiple log sources (endpoint, cloud, container, SaaS)
• Support cyber forensic investigations using diverse telemetry
• Optimize log ingestion and telemetry collection for high-quality, actionable security data while managing volume and cost
• Design and build SOAR playbooks and automation workflows for:
  • detection triage
  • enrichment
  • response actions
• Mentor and share knowledge with other detection engineers on threat hunting, detection engineering, and investigations

Requirements (Minimum)

• 2+ years experience in detection engineering, incident response, or offensive security
• Experience with public cloud platforms (AWS, Azure, or GCP)
• Strong understanding of attacker TTPs in modern zero trust environments (e.g., identity compromise, token theft, trust boundary abuse)
• Proficiency with macOS internals and telemetry to identify macOS-specific threats
• Experience implementing detection-as-code practices (version control, peer review, automated testing, CI/CD deployment)
• Basic proficiency in Python, Golang, or other scripting/programming languages
• Relevant certifications such as GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar

Nice to Have (Preferred)

• Background in offensive security / red teaming
• Knowledge of machine learning for threat detection