About the job
At SenseOn, we are pioneering the future of security operations, where artificial intelligence not only assists security analysts but also leads in detection engineering. We are in search of a talented Security Engineer who can excel in two critical areas: crafting high-quality detection rules that thwart real-world adversaries today, and developing the infrastructure that will empower AI to autonomously create and refine these rules in the future.
The threat landscape is evolving rapidly, with adversaries increasingly leveraging AI to enhance their attack methodologies, automate reconnaissance efforts, produce sophisticated phishing schemes at scale, and adapt their tactics faster than traditional detection mechanisms can keep pace. We require a professional who comprehends this emerging category of AI-driven attacks and can devise detection strategies tailored to identify unique signatures such as anomalous automation patterns, LLM-generated content in phishing campaigns, rapid and expansive enumeration, and AI-assisted lateral movement. To detect AI, one must think like AI.
This role bridges the gap between analysis and development, requiring a versatile skill set that encompasses both domains.
Key Responsibilities
Detection Engineering (Core Function)
- Develop and uphold detection rules within SenseOn's dual-engine architecture:
- Real-time streaming detections that are evaluated in milliseconds, authored in YAML and compiled into binary rules
- Batch behavioral detections supported by parameterized ClickHouse SQL, operating on a seconds-to-minutes cycle
- Create aggregations and materialized views in ClickHouse to establish statistical anomaly baselines
- Enhance our query library for threat hunting with MITRE-mapped ClickHouse queries utilized daily by analysts
- Accurately map each rule to MITRE ATT&CK techniques and tactics, including sub-technique specificity
- Instrument your own rules: assess false positive rates, define confidence metrics, construct test datasets, and ensure the quality of deliverables
- Refine detections based on real-world telemetry. Understanding the rationale behind rule activations is as essential as the activations themselves
AI-Driven Detection Platform (Strategic Mission)
- Broaden the capabilities of our existing LLM-driven rule writing engine
- Design and establish pipelines for LLMs to propose detection rules based on threat intelligence, CVE disclosures, or analyst findings, with structured outputs, YAML validation, and human approval checkpoints
- Create feedback loops: when a detection is triggered or results in a false positive, this feedback should inform and enhance future AI-generated rules
- Define prompt engineering and evaluation frameworks for detection generation, focusing on metrics such as Pass@k, FP/TP scoring, and MITRE alignment validation
- Collaborate with engineering to make the detection data model comprehensible to AI, including schemas, annotations, and contextual structures that LLMs can reliably process