Security Detection Engineer

Whoop•Boston, MA

5d•$130,000 - $170,000

About The Position

WHOOP is seeking a Security Detection Engineer to join its growing Information Security team and report directly to the Information Security Manager. This hands-on technical role is responsible for designing, building, and continuously improving scalable, high-fidelity detection capabilities that safeguard sensitive biometric and health data for WHOOP members. The engineer will strengthen detection across cloud, identity, endpoint, network, and application environments by identifying emerging threats, improving detection accuracy, and reducing security risk. The role offers ownership of the detection engineering program and an opportunity to influence its technical direction as WHOOP scales.

Requirements

At least 4 years of hands-on Information Security experience, focused on detection engineering, threat detection, or security operations.
Demonstrated experience writing and tuning detections across cloud, identity, endpoint, or application environments.
Familiarity with detection frameworks and tools such as YARA, SIGMA, Suricata, or similar rule-based detection methodologies.
Strong understanding of attacker techniques involving identity compromise, cloud abuse, lateral movement, and data exfiltration.
Expertise analyzing and building detections on cloud and SaaS telemetry, including authentication events, API activity, and system logs.
Strong scripting skills in a language such as Python, Go, or PowerShell for automation and tool development.
Ability to work effectively in a fast-paced, high-growth environment.
Strong analytical mindset and systems-thinking approach to reducing noise and increasing signal fidelity.
Experience supporting incident response investigations and participating in on-call rotations.
Effective communication and collaboration skills, including the ability to explain detection strategy to technical and non-technical stakeholders.

Nice To Haves

Experience building detective controls for consumer-facing platforms or detecting authentication and API abuse at scale.
Familiarity with applying data analysis or machine learning techniques to security detection or alert triage.
Bachelor’s degree in Computer Science, Information Security, or a related technical field, and/or relevant security certifications.

Responsibilities

Design, build, and scale high-signal detections across cloud, identity, endpoint, network, and application layers using Detection-as-Code principles.
Develop and maintain detection logic aligned with real-world attacker behavior and frameworks such as MITRE ATT&CK across modern security platforms.
Translate threat intelligence into actionable detections and validate their effectiveness through adversary emulation and testing.
Build behavioral detections for threats including account takeover, credential abuse, API misuse, automation attacks, privilege escalation, and data exfiltration.
Improve detection quality by tuning alerts, reducing false positives, and implementing automated enrichment and triage.
Define and track detection KPIs, such as precision, recall, false-positive rate, and MTTD, and implement processes to measure and improve detection health.
Support and lead incident investigations, including containment, root cause analysis, and post-incident detection improvements.
Contribute to the on-call rotation and proactively reduce operational overhead through automation.
Partner with Engineering, IT, Infrastructure, Product, and GRC to ensure systems launch with strong monitoring and detection coverage.
Map detections to threat models, identify visibility gaps, and improve coverage as the environment scales.
Explore and apply advanced analytics and machine learning techniques to improve detection fidelity, reduce noise, and enhance triage and investigation workflows.
Research emerging attack techniques and incorporate findings into detection strategy.