Senior Detection and Response Engineer (Cheltenham, UK)

Location: 100% remote, but candidates must be located in or around Cheltenham, United Kingdom

Company

hirify.global develops exploit and vulnerability intelligence products that support data lakes, ETL pipelines, automation, and AI/LLM workflows.

What you will do

• Design and direct AI-assisted, agentic detection workflows for an accelerating volume of vulnerabilities.
• Author and ship network signatures that identify internet-scale services, versions, and vulnerable hosts.
• Build Canary telemetry detections that distinguish real exploitation from internet noise and turn findings into actionable threat intelligence.
• Guide probing and collection feedback loops, identifying coverage gaps and necessary telemetry.
• Evaluate and tune detection quality by measuring false-positive and false-negative rates.
• Respond rapidly to high-impact vulnerabilities and collaborate with vulnerability researchers and threat hunters.

Requirements

• 5+ years of experience building and shipping durable detections over network and host data.
• Experience scaling detection development and continuous evaluation with AI and agentic workflows using human oversight.
• Experience researching, engineering, and validating detections across network and host telemetry with disciplined false-positive and false-negative analysis.
• Expertise in device fingerprinting and protocol analysis, including identifying services behind open internet ports.
• Knowledge of attacker command-and-control techniques, covert channels, exploitation artifacts, and network traffic analysis.
• Background in host-based analysis and DFIR, including selecting useful sensor telemetry and synthesizing actionable threat intelligence.
• Strong programming or scripting ability for performant detection logic integrated with engineering systems.
• Familiarity with CVE, NVD, KEV, or exploit intelligence datasets.
• A response mindset and ability to analyze newly disclosed vulnerabilities and ship detection coverage quickly.

Nice to have

• Experience developing and tuning detections in Suricata, Snort, Zeek, or similar tools.
• Experience writing Nuclei templates or other scanner signatures.
• Published detection research, signatures, or open-source detection content.
• Experience with streaming systems or real-time data processing.
• Background in high-growth or startup environments.

Culture & Benefits

• Transparent, collaborative, supportive, curious, and innovative working culture.
• Work with cybersecurity products focused on protecting critical infrastructure, including medical devices, power grids, and telecommunications networks.
• Remote work is available, subject to the Cheltenham-area location requirement.
• Equal employment opportunity employer committed to reasonable accommodations for applicants with disabilities.