Detection Engineering Jobs in Cybersecurity
Detection engineering treats security telemetry as code - building, testing, and tuning detections at scale across SIEM, EDR, and cloud-native tooling. SOC, threat hunting, and incident response sit alongside this work.
156 open Detection Engineering roles listed
Hiring? Read how to hire a SOC Analyst →
Get weekly alerts for new Detection Engineering jobs:
Common certifications for Detection Engineering roles
Posted Aug 28
Posted Aug 25
Posted Aug 25
Posted Aug 21
Posted Aug 21
Posted Aug 21
Detection EngineeringRemote
Posted Aug 21
Posted Aug 20
Posted Aug 19
Detection Engineering jobs by country
Frequently asked questions
- Are Detection Engineering jobs in demand in cybersecurity?
- Yes. We currently list 156 open Detection Engineering roles across cybersecurity employers worldwide, refreshed continuously as our pipeline runs.
- What certifications help for Detection Engineering roles?
- Commonly requested certifications for Detection Engineering roles include GCIA, GCIH, GCFA, GCFE, CySA+, BTL1, BTL2. Requirements vary by employer and seniority - many roles weigh hands-on experience as heavily as certs.
- Where can I find Detection Engineering jobs?
- Detection Engineering roles are available across regions including United States, Canada, United Kingdom, Germany, Netherlands, France, Singapore, Australia, alongside remote-friendly positions. Use the country links on this page to filter by location.
- Can Detection Engineering jobs be done remotely?
- Many Detection Engineering roles offer remote or hybrid arrangements, though some require on-site or hybrid presence depending on the employer. Browse our remote cybersecurity jobs to filter for fully-remote positions.
- How do I apply for Detection Engineering jobs?
- Open any listing to view the role, then apply directly on the employer's official site - every job links straight to the company's own application page, with no middleman.
- What does a threat detection engineer do?
- A threat detection engineer builds and tunes the logic that turns raw security telemetry into alerts: writing detection rules for SIEM and EDR platforms, testing them against real attack techniques (often mapped to MITRE ATT&CK), reducing false positives, and covering gaps the SOC finds during incidents. The title overlaps heavily with detection engineer and senior SOC analyst roles, and the listings on this page cover all three.