Detection Engineer II

Instacart

5d•$142,000 - $180,500•Remote

About The Position

Instacart’s Detection Engineering team builds and operates systems to identify, surface, and respond to threats across its cloud-native platform. The team owns the detection lifecycle, from telemetry collection and signal design through automated response, across endpoint, cloud, container, and SaaS environments. The Detection Engineer develops high-fidelity detection logic, hunts for novel attacker techniques, and improves detection coverage, quality, and scale in collaboration with Engineering, Red Team, Incident Response, Fraud, and Trust & Safety. The team follows a detection-as-code approach, using versioned, tested, repeatable deployment pipelines, and focuses on reducing noise and improving analyst efficiency through automation and SOAR. The role involves developing, tuning, documenting, and maintaining detections across multiple log sources; assisting with cyber forensic investigations; optimizing log ingestion and telemetry collection; and building SOAR playbooks and automation workflows for triage, enrichment, and response. The engineer also shares knowledge with colleagues on threat hunting, detection development, and investigation techniques.

Requirements

At least 2 years of experience in detection engineering, incident response, or an offensive security role.
Experience with at least one public cloud platform: AWS, Azure, or GCP.
Deep understanding of attacker TTPs in modern zero-trust environments, including identity compromise, token theft, and abuse of trust boundaries.
Proficient understanding of macOS internals and telemetry available to identify macOS-specific threats.
Experience implementing detection-as-code workflows, including version control, peer review, automated testing, and CI/CD deployment pipelines.
Basic proficiency with Python, Golang, or another programming or scripting language.
Relevant certification such as GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar.

Nice To Haves

Background in offensive security or red teaming.
Knowledge of machine learning for threat detection.

Responsibilities

Develop, tune, document, and maintain detection logic across endpoint, cloud, container, and SaaS log sources.
Assist in cyber forensic investigations across a variety of log sources.
Optimize log ingestion pipelines and telemetry collection to provide high-quality, actionable security data while managing volume and cost.
Design and build SOAR playbooks and automation workflows to streamline detection triage, enrichment, and response actions.
Mentor and share knowledge with other detection engineers on threat hunting methodologies, detection logic development, and investigation techniques.