Senior Detection Engineer, EDR – Defensive Agent

Horizon3.ai

. Partner with Product to turn EDR effectiveness and tuning ambitions into concrete, buildable requirements .

Posted 9/19/2026full-timeRemote • United StatesSenior💰 $195,000 - $230,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in detection engineering and security operations, with a strong focus on EDR platform administration, tuning, and incident response. Capable of translating complex technical requirements into actionable product outcomes while maintaining a deep understanding of SOC workflows and adversary behaviors.

Highest-signal resume keywords

Detection EngineeringEDR Platform AdministrationMITRE ATT&CK FrameworkTechnical WritingScripting in Python

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection WritingPolicy ManagementExclusion ManagementIncident ResponseThreat HuntingData AnalysisTelemetry InspectionAlert InvestigationTuning RecommendationsFalse Positive Analysis

Soft Skills

Influencing Without AuthorityCross-Functional CommunicationCollaboration

Tools & Technologies

EDR PlatformsSQLAPIs

Industry Keywords

SOC WorkflowsAdversary TradecraftDetection Coverage MeasurementEndpoint TelemetryIdentity Telemetry

Tech Stack

Tools & technologies

PythonSQL

About the role

Key responsibilities & impact

Partner with Product to turn EDR effectiveness and tuning ambitions into concrete, buildable requirements
Translate blue team workflows and pain into prioritized product outcomes
Push back on features or agent behavior that would not hold up in a real SOC
Define acceptance criteria for detection, effectiveness, and tuning features
Validate releases against acceptance criteria before customers see them
Serve as the domain reference for Engineering and AI research
Provide design reviews, technique guidance, and vendor behavior guidance
Own current knowledge of major EDR and endpoint platforms at the console, policy, telemetry, and API levels
Maintain knowledge of detection logic, prevention policies, exclusions, and tuning across products
Define vendor-specific policy semantics across differently modeled platforms
Track platform changes, new detection capabilities, and vendor guidance
Keep the coverage model current as vendors ship changes
Define correct tuning recommendations and grade agent output against that standard
Partner with the Attack team to ground technique coverage and detection expectations in current adversary tradecraft

Requirements

What you’ll need

6+ years in detection engineering, security operations, incident response, or threat hunting
Meaningful practitioner experience rather than solely advisory experience
Hands-on production experience administering and tuning EDR platforms
Experience writing detections, managing policies and exclusions, and investigating real alerts
Deep understanding of SOC workflows involving EDR output
Understanding of false-positive and false-negative tradeoffs, alert fatigue, and detection coverage measurement
Strong working knowledge of MITRE ATT&CK and detection coverage frameworks
Understanding of post-compromise attacker behavior and endpoint and identity telemetry
Experience shaping a product or platform as a domain expert
Ability to influence without authority
Exceptional technical writing skills
Ability to translate between engineers, AI researchers, product managers, SOC analysts, and executives
Scripting ability, ideally Python, to query APIs, inspect telemetry, and prototype analyses
Comfort with SQL and large volumes of event and telemetry data

Benefits

Comp & perks

Equity package in the form of stock options for all full-time roles
Health, vision, and dental insurance for you and your family
Flexible vacation policy
Generous parental leave
Career development opportunities
Inclusive and collaborative culture
Remote and hybrid work models depending on role and location