Detection Engineer (AI)

Location: Hybrid, with 3–4 days per week in-office in London, Krakow, or New York

Company

hirify.global is building a fintech app for Latin America.

What you will do

• Own end-to-end detection engineering in Datadog Cloud SIEM, including identifying missing log sources, prioritising onboarding, and building reliable coverage.
• Write, test, tune, and manage detections as code using version control, Terraform, CI pipelines, and code review.
• Map detections to MITRE ATT&CK and validate coverage by reproducing attacker activity.
• Build and operate automation and AI agents for rule authoring, validation, coverage mapping, alert triage, and threat hunting.
• Investigate incidents through triage, scoping, evidence collection, documentation, and remediation, while helping develop automated response and containment.
• Track and communicate detection coverage, validation results, and response performance to security leadership.

Requirements

• 5+ years of security experience, including 3+ years writing and owning production detections.
• Hands-on experience with a cloud SIEM and its query language, such as Datadog Cloud SIEM, Splunk, Elastic, or Google SecOps.
• Deep knowledge of AWS logs, particularly CloudTrail, IAM, and IAM Identity Center, plus SaaS audit logs from platforms such as Google Workspace, GitHub, GitLab, or Okta.
• Experience managing detections as code with Terraform, Git, CI pipelines, and code review.
• Practical MITRE ATT&CK mapping and rule testing through attack reproduction with tools such as Atomic Red Team or Stratus Red Team.
• Python skills for automation, log analysis, and security tooling, with experience shipping automation or AI agents used by others.
• Hands-on incident response experience, from alert investigation through findings and remediation documentation.
• Ability to work independently, prioritise effectively, and own outcomes in a small team without a dedicated SOC.
• Strong written and verbal English communication.

Nice to have

• Familiarity with CrowdStrike Falcon, Datadog SIEM, Cloudflare Zero Trust, or WAF.
• Experience with Kubernetes, including EKS audit logs.
• Threat hunting, red team, or purple team experience.
• Experience building agentic workflows with Claude or OpenAI.
• Fintech, payments, or crypto background with exposure to SOC 2 or PCI DSS.
• Spanish or Portuguese language skills.

Culture & Benefits

• Hybrid office policy requiring 3–4 days per week in-office.
• Competitive salary and benefits, plus a discretionary performance bonus.
• Stock options providing ownership in the product.
• Access to current tools and technology and a challenging, skills-focused team environment.
• Opportunity to build a fintech app for the Latin American market.