{"id":3782896,"url":"https://alion.io/job/exaforce-detection-and-response-engineer","title":"Detection and Response Engineer","company":{"id":451082,"name":"Exaforce","domain":"exaforce.com","url":"https://alion.io/company/exaforce","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"Python","optional":false},{"name":"SQL","optional":false},{"name":"GitHub","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"Okta","optional":true},{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-11-05T01:35:45Z","employer_posted_date":null,"last_verified_at":"2026-11-05T01:35:45Z","board_verified":false,"closed_at":null,"days_open":2,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":2},"description":"Responsibilities: \nMonitor, triage, and investigate security alerts across customer cloud environments, determining scope, impact, and root cause.\nDevelop, tune, and maintain detection rules and correlation logic to improve fidelity and reduce false positives.\nConduct proactive, hypothesis-driven threat hunts to uncover previously unknown threats and detection gaps.\nRespond to security incidents, executing containment and eradication steps and recommending recovery actions; escalate high-severity incidents as appropriate.\nParticipate in the team's on-call/rotational schedule to support 24/7 detection and response coverage.\nWrite clear, accurate incident reports and customer-facing updates on findings and remediation guidance.\nContribute to and maintain playbooks, runbooks, and standard operating procedures for the DRE function.\nBuild scripts and automations (Python, Bash, SQL) to speed up investigations and response workflows.\nMap detections and investigations to the MITRE ATT& CK framework to track coverage.\nShare field-identified detection gaps, tooling needs, and platform feedback with Product and Engineering.\nCollaborate with Software Development, SRE, and Customer Success teams on customer onboarding and platform integrations.\nMentor peers and share knowledge through investigation reviews, write-ups, and internal sessions.\n\nRequirements: \n3-6+ years of experience in security operations, detection engineering, threat hunting, or incident response.\nHands-on experience working in a SOC or MDR environment, including alert triage and on-call/rotational coverage.\nProven ability to write, test, and tune detection logic and correlation rules.\nSolid incident response experience, including hands-on containment, eradication, and recovery.\nWorking knowledge of security in at least one major cloud provider (AWS, Azure, or GCP).\nProficiency in scripting (Python, Bash) and querying data with SQL or similar query languages.\nStrong analytical and problem-solving skills, with attention to detail under pressure.\nExcellent written and verbal communication skills, including the ability to explain technical findings to customers.\nBachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.\n\nPreferred Skills: \nDeep experience across multiple cloud providers (AWS, Azure, GCP), including identity and logging services (e. g., CloudTrail, Entra ID, Cloud Audit Logs).\nFamiliarity with securing code and identity repositories and SaaS platforms (e. g., GitHub, Atlassian, Okta).\nStrong working knowledge of the MITRE ATT& CK framework and applying it to detection development.\nExperience with SIEM, EDR, SOAR, or detection-as-code tooling.\nExperience working with globally distributed teams across time zones.\nExperience at a startup or high-growth security company.\nRelevant certifications (e. g., GCIH, GCFA, GCIA, AWS/Azure/GCP security certifications, OSCP) are a plus.\nSkills\nAWS, Azure, Bash, Cloud, Detection, GCP, Incident Response, Python, Response, SQL","description_format":"text","description_chars":3037,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Security Operations"],"lifecycle":[{"event":"open","at":"2026-11-05T01:35:45Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":2,"expected_fill_days":29,"reasons":["seen:2","win:early"],"computed_at":"2026-11-07T05:47:08Z"},"pay":null,"html_url":"https://alion.io/job/exaforce-detection-and-response-engineer","json_url":"https://alion.io/job/exaforce-detection-and-response-engineer.json","meta":{"generated_at":"2026-11-07T08:22:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4818,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":451082},"rest":"https://alion.io/mcp/rest/get_company?id=451082"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fexaforce-detection-and-response-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fexaforce-detection-and-response-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fexaforce-detection-and-response-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/exaforce-detection-and-response-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fexaforce-detection-and-response-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3782896}},{"tool":"search_jobs","arguments":{"company":"exaforce.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3782896},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}