Security Detection Engineer (Cybersecurity)

Location: Poland; remote or office work options available

Company

hirify.global delivers engineering and technology services, including cybersecurity and SaaS solutions.

What you will do

• Design behavioral models and production-ready detections for malicious network activity and anomalies.
• Develop detection logic for beaconing, DGA, data staging, lateral movement, DNS tunneling, scanning, port hopping, and unusual remote administration.
• Build, evaluate, and continuously tune detections using precision, recall, false-positive rate, and MITRE ATT&CK coverage.
• Use production-scale telemetry in Databricks to validate detection performance.
• Collaborate with threat intelligence and engineering teams to turn threat research into detection content and productionize it in SaaS and potential on-premise environments.
• Support threat hunting, investigations, triage, and documentation of detection methodology and tuning decisions.

Requirements

• Experience developing rule-based, signature-based, or behavioral detection content for network threats.
• Strong knowledge of TCP/IP, DNS, HTTP/S, TLS, SSH, traffic analysis, network architecture, and common attack vectors.
• Proficiency in Python and SQL for detection development and data analysis.
• Experience with Sigma, Snort, Suricata, or similar detection formats.
• Practical experience applying AI/ML techniques to security detection, including anomaly detection, classification, or behavioral modeling.
• Experience with SecOps workflows, threat intelligence tools, NDR, security analytics or SIEM solutions, and MITRE ATT&CK mapping.

Nice to have

• Endpoint security experience.

Culture & Benefits

• Remote or office work format in Poland.
• Collaboration with threat intelligence teams, including Cisco Talos.
• Cross-team knowledge sharing across security and engineering functions.