Detection and Response Engineer - UK

Senior Detection and Response Engineer (Cheltenham, UK)

Location: Cheltenham, UK

Team: Product & Engineering

Employment Type: Full-Time, Remote

About VulnCheck

Exploitation prevention is only as strong as the intelligence driving those efforts, and most of the industry is still running on intelligence that lacks exploit context. VulnCheck, The exploit intelligence company, delivers structured exploit intelligence on what is actively weaponized in the wild, purpose-built for the data lakes, ETL pipelines, automation, and AI and LLM workflows your infrastructure already runs on, raising the capability of everything it powers.

About the Role

Our Target and Canary Intelligence products provide unique visibility into vulnerable assets on the internet, attacker infrastructure, and attacks that leverage vulnerabilities for initial access. Target Intelligence maintains a continuously updated view of internet-facing systems — the services and versions they run, and their exposure to vulnerabilities. Canary Intelligence deploys intentionally vulnerable systems across the internet and captures real exploitation attempts as they happen.

We are looking for an experienced detection and response engineer to help scale the durable detections behind these products. These detections generate world-class, vulnerability-centric threat intelligence our customers rely on to defend themselves against exploitation activity on the internet.

You'll have wide latitude to shape how VulnCheck stays ahead of an accelerating volume of vulnerabilities - the tooling, the workflows, and the standards for detection engineering at scale. Although this is a 100% remote role, candidates must be located in or around Cheltenham, United Kingdom.

What You'll Do

• Design and direct AI-assisted, agentic detection workflows that scale coverage to an accelerating volume of vulnerabilities, with you on the loop for quality
• Author and ship network signatures and detections against internet-scale scan and probe data to identify services, versions, and whether hosts are vulnerable.
• Build detections against Canary telemetry that separate real exploitation signal from internet noise, and synthesize that signal into threat intelligence customers can act on
• Drive feedback loops into our probing and collection capabilities - identifying what data we should collect, what we shouldn't, and where coverage gaps exist
• Continuously evaluate detection quality, measuring and tuning false positive and false negative rates
• Respond rapidly when high-impact vulnerabilities drop - analyze, build coverage, ship
• Work alongside our vulnerability researchers and threat hunters to connect detection engineering with exploit intelligence

What You'll Bring

• 5+ years of experience building and shipping durable detections over network and host data
• Experience scaling detection development and continuous evaluation processes using AI and agentic workflows with humans on the loop
• A track record of researching, engineering, and validating durable detections across network and host telemetry, with a disciplined approach to false positives and false negatives
• Expertise in device fingerprinting and protocol analysis. You understand the nuances of how services manifest on the wire, and how these signals stack to passively uncover what is running behind an open port on an internet address
• Knowledge of attacker command-and-control techniques, covert channels, and exploitation artifacts — and how to identify them through network traffic analysis
• A background in host-based analysis and DFIR. You know what telemetry is worth collecting from sensors to identify exploitation activity and attacker behaviors, and how to synthesize it into high-quality, actionable threat intelligence
• Strong programming or scripting ability — you can codify detection logic so it is performant and integrates cleanly with VulnCheck’s engineering system
• Familiarity with CVE, NVD, KEV, or exploit intelligence datasets
• A response mindset — when a new vulnerability drops, you're the first to dig in, analyze it, and ship detection coverage

Preferred Qualifications

• Experience developing and tuning detections in Suricata, Snort, Zeek, or similar, and writing Nuclei templates or other scanner signatures
• Published detection research, signatures, or open-source detection content
• Experience with streaming systems or real-time data processing
• Background in high-growth or startup environments

Why Join Us

Built on over two decades of cybersecurity experience, our team of experts understands the intricacies of vulnerabilities, their exploitation in the wild, and how to leverage this data to build more effective cybersecurity products that produce better outcomes for organizations.

VulnCheck gives organizations a tactical advantage by providing best-in-class exploit & vulnerability intelligence information. We have a sense of duty to protect the critical infrastructure we rely on including medical devices, power grids and telecommunication networks. We were founded in 2021 in Lexington, Massachusetts.

VulnCheck has a transparent, collaborative, and supportive culture — we are looking for people who have a growth mindset, are curious and innovative. Our team is smart, but humble, hardworking, and supportive.

VulnCheck is proud to be an Equal Employer Opportunity employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. VulnCheck is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities. Even if your experience doesn't perfectly align with the job description, we encourage you to apply — we value potential just as much as a perfect resume.