Security Detection Engineer

Whoop•Boston, MA

4d•$130,000 - $170,000

About The Position

WHOOP is seeking a hands-on Security Detection Engineer to join its Information Security team and help protect sensitive biometric and health data. Reporting directly to the Information Security Manager, this role will own and improve scalable, high-fidelity detection capabilities across cloud, identity, endpoint, network, and application environments. The engineer will help shape WHOOP’s detection engineering program, identify emerging threats, improve detection accuracy, and reduce security risk as the company scales. The role uses Detection-as-Code principles, threat intelligence, attacker-behavior frameworks, adversary emulation, automation, and analytics to build and maintain detections. It includes incident investigation and on-call participation, collaboration with teams across the company, and ongoing work to measure detection effectiveness and address visibility gaps. This is a full-time position with a U.S. base salary range of $130,000–$170,000. The successful candidate will also receive benefits and an equity package.

Requirements

At least 4 years of hands-on Information Security experience focused on detection engineering, threat detection, or security operations.
Demonstrated experience writing and tuning detections across cloud, identity, endpoint, or application environments.
Familiarity with detection frameworks and tools such as YARA, SIGMA, Suricata, or similar rule-based detection methodologies.
Strong understanding of attacker techniques involving identity compromise, cloud abuse, lateral movement, and data exfiltration.
Expertise analyzing and building detections on cloud and SaaS telemetry, including authentication events, API activity, and system logs.
Strong scripting skills in a language such as Python, Go, or PowerShell for automation and tool development.
Ability to operate effectively in a fast-paced, high-growth environment.
Strong analytical mindset and a systems-thinking approach to reducing noise and increasing signal fidelity.
Experience supporting incident response investigations and participating in on-call rotations.
Effective communication and collaboration skills, including the ability to explain detection strategy to technical and non-technical stakeholders.

Nice To Haves

Experience building detective controls for consumer-facing platforms or detecting authentication and API abuse at scale.
Familiarity with applying data analysis or machine learning techniques to security detection or alert triage.
A bachelor’s degree in Computer Science, Information Security, or a related technical field, and/or relevant security certifications.

Responsibilities

Design, build, and scale high-signal detections across cloud, identity, endpoint, network, and application layers using Detection-as-Code principles.
Develop and maintain detection logic aligned with real-world attacker behavior and frameworks such as MITRE ATT&CK.
Translate threat intelligence into actionable detections and validate effectiveness through adversary emulation and testing.
Build behavioral detections for threats including account takeover, credential abuse, API misuse, automation attacks, privilege escalation, and data exfiltration.
Improve detection quality by tuning alerts, reducing false positives, and implementing automated enrichment and triage.
Define and track detection KPIs, including precision, recall, false positive rate, and MTTD, and implement processes to measure and improve detection health.
Support and lead incident investigations, including containment, root cause analysis, and post-incident detection improvements.
Participate in the on-call rotation and proactively reduce operational overhead through automation.
Partner with Engineering, IT, Infrastructure, Product, and GRC to ensure systems launch with strong monitoring and detection coverage.
Map detections to threat models, identify visibility gaps, and improve coverage as the environment scales.
Explore and apply advanced analytics and machine learning techniques to improve detection fidelity, reduce noise, and enhance triage and investigation workflows.
Research emerging attack techniques and incorporate findings into detection strategy.