Detection Engineering & Response Lead

About This Opportunity

We are representing a confidential cloud infrastructure organization in a search for a Detection Engineering & Response Lead. This is a hands-on leadership role where you'll build and run the detection and response capability from the ground up, owning detection engineering, threat intelligence, and incident response functions across a modern cloud platform.

You'll lead a small, growing team of analysts and engineers while remaining deeply technical—writing detections, handling complex incidents, performing forensics, and shaping the overall D&R strategy.

Location: Israel, Netherlands, or United Kingdom
Employment Type: Full-time

Responsibilities

• Lead detection development to achieve comprehensive MITRE ATT&CK coverage while maintaining low false-positive and false-negative rates
• Work closely with internal consumers across 20+ teams to keep alert noise low and signal high, ensuring they can act quickly without missing genuine threats
• Architect and operate detection coverage across cloud and bare-metal environments
• Build and extend internal D&R tools and pipelines—onboard new logs, build and automate response runbooks
• Integrate threat intelligence into detection logic and IR playbooks, tracking adversary TTPs relevant to cloud infrastructure
• Lead incident response end-to-end: scoping, containment, root cause analysis, post-incident reviews, and ensuring critical action items are closed
• Partner with Compliance and Engineering teams to detect real threats while meeting the needs of both engineers and regulators
• Define and report on D&R metrics: MTTD, MTTR, detection coverage, false positive rates
• Build and maintain the Security Incident Response program: people, processes, and tools
• Create tools, runbooks, and on-call processes that scale as the organization grows

What We're Looking For

Required:

• 6+ years in security operations, detection engineering, or incident response—with at least 1–2 years leading or mentoring a team
• Deep hands-on experience with cloud-native environments (Kubernetes, Linux workloads, container-based infrastructure)
• Strong detection engineering skills: writing and tuning rules/detections in SIEM platforms (e.g., Chronicle, Splunk, Elastic) and SQL
• Experience building or operating SOAR workflows and automating response at scale (ideally with Golang and Temporal)
• Working knowledge of threat intelligence frameworks (MITRE ATT&CK, Pyramid of Pain, Kill Chain) and how to operationalize them in detections
• Solid IR fundamentals: memory forensics, log analysis, network traffic analysis, and post-incident reporting
• Stakeholder management: able to coordinate across engineers, compliance, legal, and executives during active incidents; serve as the primary owner for complex post-mortem changes
• Authorization to work in the country in which you apply

Nice to Have:

• Experience with AI/ML and GPU cluster-related threats
• Familiarity with eBPF-based detection or runtime security tooling (Falco, Tetragon)
• Background in threat hunting

How We Work With You

Our talent team at Get A Job.ai partners with leading organizations to connect exceptional candidates with confidential opportunities. Here's our process:

• Apply directly through the Get A Job.ai platform
• A dedicated recruiter will screen your application and conduct an initial interview
• If there's a strong match, we'll submit your profile to our client for consideration
• Please do not attempt to contact the client directly—all communication flows through Get A Job.ai to ensure a smooth, professional process

Pay

Compensation details will be discussed during the screening process and are competitive within the market for this level of expertise.

Equal Opportunity: Get A Job.ai is committed to inclusive hiring practices. We welcome applications from candidates of all backgrounds and provide equal employment opportunities regardless of race, color, religion, sex, national origin, age, disability, genetics, marital status, veteran status, sexual orientation, gender identity, or any other protected characteristic. If you need accommodations during the application process, please let us know.