Detection and response
Detection Engineer
Design, test and tune detections across endpoint, cloud, application and network telemetry. You will measure what each rule catches and what it misses, and treat detections as code that can be tested.
About the role
Why this role exists
Prava AI covers endpoint protection, application, server and cloud monitoring, IoT/OT monitoring and phishing defence. Each depends on detections that fire on real attacks and stay quiet otherwise. A detection that floods analysts with noise is as harmful as one that never fires.
This role builds and maintains those detections. You will write rules and analytics, combine them with the platform's detection models, and test them against both simulated attacks and normal activity. Every detection should have a known purpose, a test that proves it works and a measured false positive rate.
You will work with security researchers and threat intelligence analysts on what to detect, with DFIR on what real incidents looked like, and with the AI team on where models outperform rules and where they do not.
Responsibilities
What you will do
- Write, test and tune detection logic across endpoint, cloud, identity, application and network telemetry.
- Build test cases for each detection using attack simulation and recorded benign activity, and run them in continuous integration.
- Measure coverage against frameworks such as MITRE ATT&CK and identify meaningful gaps.
- Track precision and false positive rates in production and tune or retire detections that do not earn their place.
- Write clear context for each alert: what it means, why it matters and what an analyst should check first.
- Work with the AI team to combine rule-based and model-based detection, and evaluate both honestly.
- Turn lessons from incidents and research into new or improved detections.
Requirements
What you will bring
We care about what you can do, not where or how you learned it. If you meet most of these, we would like to hear from you.
- Experience writing and maintaining detections in a production security operations or product environment.
- A solid understanding of attacker techniques and the telemetry they leave behind.
- Experience with at least one detection language or format, such as Sigma, YARA, KQL, SPL or EQL.
- Experience testing detections with attack simulation and measuring their performance.
- Scripting ability, for example in Python, to automate testing and analysis.
- Familiarity with endpoint, cloud provider and identity logs, and how they differ in quality.
- The discipline to treat detections as code: versioned, reviewed and tested.
Nice to have
Helpful, not required
ML
Model-based detection
Experience evaluating anomaly detection or classifiers for security use.
OT
Industrial telemetry
Familiarity with IoT or OT protocols and their threats.
Phishing detection
Experience detecting phishing and business email compromise.
Community
Shared rules
Contributions to public detection rule sets or research.
Your first months
What progress looks like
These are typical outcomes, not fixed targets. Your manager will agree goals with you when you join.
First month
Settle in
You have learned the detection pipeline, test framework and telemetry sources, and shipped a tuned or new detection with tests.
First three months
Contribute
You own a detection area, such as identity or cloud control plane, and have measured its coverage and precision with a written plan to improve it.
First six months
Own
Your detections are measurably better in your area, and you are shaping how rules and models work together across the platform.
Tools and environment
How you will work
You will work with tools such as Sigma, YARA, Atomic Red Team, Caldera, Sysmon, osquery, Zeek, cloud provider audit logs and log query languages such as KQL, together with Git-based detection-as-code workflows and continuous integration.
Specific internal tooling is covered during onboarding.
Hiring process
How we hire for this role
This follows our usual hiring process, adapted to the role. We reply to every application and tell you in advance what each stage involves.
- Application. Your CV and a short note. Links to public rules or research are welcome.
- Introductory call. Your experience, the detections you are proud of and what you want next.
- Technical conversation. A discussion of how you designed, tested and tuned a detection.
- Practical exercise. A scoped exercise to write and test a detection against a synthetic dataset. We do not use your work in our product.
- Final conversations and offer. Time with leadership, then a written offer from an @prava.dev address.
Security and ethics
Working responsibly
Note. Detection engineers may work with customer telemetry, which is handled under strict confidentiality and stays in the customer's region. Attack simulation runs only in our labs or under written authorisation. Offers may be subject to background checks where the law allows.
We never ask candidates for payment, bank details or fees, and interviews and offers come only from @prava.dev addresses. Read more about recruitment fraud and how we handle your application data under our Privacy Policy.
Benefits
What we offer
Benefits vary by country and employing entity, and the specifics are set out in each offer. They include pay set for the role and location, health cover, paid leave, support for learning, the equipment you need and working arrangements that suit the role. See benefits on the careers page. We are an equal opportunity employer; if you need an adjustment at any stage, tell us at careers@prava.dev.
Other open roles
Explore the team
- Security Researcher (Offensive) · Research
- Machine Learning Engineer (Security LLM) · AI
- DFIR Analyst · Detection and response
- Threat Intelligence Analyst (Dark Web) · Intelligence
- Backend Engineer (Platform) · Engineering
- Solutions Engineer · Customers
- Compliance and GRC Specialist · Customers
Do not see the right fit? Send a general application.
Next step
Apply for this role
Send your CV and a short note about a detection you built and how you measured it. Public rules, repositories or write-ups are welcome; describe your part and credit collaborators fairly. The Apply button opens an email to careers@prava.dev with the role in the subject line.