Senior Security Engineer, Detection Engineering

NVIDIA•US, CA, Remote, TX

1d•$168,000 - $310,500

About The Position

NVIDIA Security is hiring a Senior Detection Engineer for its Detection and Automation Engineering team. The team builds reliable, explainable, measurable, and maintainable detection coverage to help responders identify real threats quickly, reduce unnecessary alerts, and protect NVIDIA's enterprise, cloud, developer, AI, and production environments. The role works closely with incident response, threat intelligence, security operations, cloud security, and engineering teams. The engineer will turn incidents, threat intelligence, red-team findings, hunts, and vulnerability context into tested production detections. This includes examining real telemetry, developing and validating detection logic, managing content throughout its lifecycle, and improving detection-as-code workflows. The role also partners with responders to reduce noise and improve context, helps shape logging and telemetry requirements, and coaches analysts and engineers through design and query reviews.

Requirements

At least 8 years of experience in detection engineering, security engineering, threat hunting, incident response, SOC engineering, or information security monitoring.
A degree in Computer Science, Cybersecurity, Engineering, or equivalent experience.
Hands-on experience building and tuning detections in a major SIEM or security analytics platform.
Strong query and scripting skills, especially SPL, KQL, SQL, Python, or similar languages for security telemetry analysis and automation.
Practical understanding of attacker behavior across identity, endpoint, cloud, network, email, collaboration tools, developer infrastructure, secrets, and data theft.
Ability to take raw logs through to production-ready detections, accounting for field semantics, thresholds, joins, baselines, false positives, missing data, and triage context.
Comfort working with Git, code review, automated checks, CI/CD, documentation, and operational ownership of shipped content.
Clear communication and sound judgment, including the ability to explain a detection's purpose, limitations, next steps, and when not to alert.

Nice To Haves

Led or materially improved a detection-as-code program across more than one security platform.
Background in cloud, identity, Kubernetes, CI/CD, supply-chain, or AI-tooling attack paths, with the ability to design detections independently.
Experience detecting abuse in developer systems, package ecosystems, secrets workflows, AI coding tools, agents, bots, or model-serving infrastructure.
Worked closely with incident response, threat hunting, red team, purple team, malware analysis, or forensics teams.
Built validation methods such as replay tests, synthetic telemetry, attack emulation, detection unit tests, or coverage reporting.

Responsibilities

Build and tune high-confidence detections across SIEM and security platforms, cloud-native logs, identity and endpoint telemetry, SaaS platforms, and developer systems.
Translate incidents, hunts, threat intelligence, red-team findings, and vulnerability context into testable, operational detection logic.
Investigate telemetry—including field behavior, timing, joins, baselines, and likely false positives—before deploying alerts.
Drive the full detection lifecycle: design, query development, validation, peer review, documentation, deployment, tuning, monitoring, and retirement.
Strengthen detection-as-code workflows through test data, quality checks, metadata, rollout safety, coverage tracking, and detection health reporting.
Partner with responders to reduce noise, add useful context, improve severity decisions, and develop follow-up detections after investigations.
Help define logging, normalization, enrichment, and retention requirements when required telemetry is missing or difficult to use.
Coach analysts and engineers through design reviews, query reviews, and guidance on credible detections.