{"id":3459743,"url":"https://alion.io/job/sygnia-detection-engineer","title":"Detection Engineer","company":{"id":49152,"name":"Sygnia","domain":"sygnia.co","url":"https://alion.io/company/sygnia","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Comeet","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Tel Aviv, Israel"],"countries":["IL"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":64000,"max_usd":156000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":854},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"SQL","optional":false}],"status":"live","first_seen_at":"2026-10-29T11:37:22Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-10-30T20:31:45Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Description\nSygnia is the foremost global cyber readiness and response team, applying creative approaches and battle-tested solutions to help organizations beat attackers and stay secure. With a team of deep digital combat, leading-edge, purpose-built technology, and enterprise security specialists, it enables companies to proactively build cyber resilience and defeat attacks within their networks. Sygnia is a trusted advisor and service provider of technology and security teams, executives and boards of leading organizations worldwide. Sygnia supports clients at each stage of their security journey, bringing frontline experience and technological acumen to help them be unstoppable in the face of cyber threats. Learn more at Sygnia.co\nThe company draws on top talent from the ranks of elite military technology units and from across the cyber industry, and has some of the world’s top talents in cyber security. Described by Forbes as a “cyber security delta force”, it applies technological supremacy, digital combat experience, data analytics and a business-driven mindset to cyber security, enabling organizations to excel in the age of cyber.\nThe Detection Engineer is responsible for designing, validating, optimizing, and continuously improving Sygnia MDR detection content across multiple security domains. This role combines threat research, security analytics, data-driven decision making, and detection engineering to ensure high-fidelity threat detection while minimizing operational noise.\nThe Detection Engineer serves as the bridge between MDR Operations, Product, Engineering, and Threat Research teams, transforming emerging threats, operational insights, and telemetry analysis into scalable and actionable detection capabilities. .\nMain Responsibilities:\nDetection Engineering & Optimization: Design, develop, maintain, and continuously optimize high-fidelity detection logic across endpoint, identity, cloud, email, network, and other security domains, maximizing coverage while minimizing false positives.\nThreat Research & Detection Coverage: Research emerging threats, vulnerabilities, and attacker TTPs, translating threat intelligence into actionable detections while identifying and closing gaps in MITRE ATT&CK and ATLAS coverage.\nDetection Quality & Performance: Establish detection quality standards, define and monitor performance metrics (precision, false positive rates, alert volume, coverage, and stability), and continuously improve detection effectiveness.\nDetection Testing & Validation: Develop testing methodologies, validation frameworks, and lab environments to evaluate detection logic through attack simulations, real-world scenarios, and repeatable testing procedures before production deployment.\nSecurity Data Research & Analytics: Analyze security telemetry, identify data quality and visibility gaps, and collaborate with Product and Engineering teams to improve data collection, normalization, enrichment, and detection capabilities.\nAI & Detection Innovation: Research, develop, and evaluate AI agents and AI-powered automation solutions for threat research, security investigations, detection engineering, and alert enrichment, ensuring measurable improvements in detection quality and operational efficiency.\nDetection Troubleshooting & Continuous Improvement: Investigate noisy or ineffective detections, perform root cause analysis, refine detection logic, and leverage operational feedback to improve alert quality and reduce analyst workload.\nClient-Specific Detection Development: Design and implement customized detection content based on client environments, security requirements, threat profiles, and available telemetry.\nOperational Excellence & Strategic Development: Drive initiatives to reduce alert fatigue, accelerate detection tuning, improve analyst efficiency, expand security visibility, and contribute to the long-term detection engineering strategy.\nRequirements\nMain Requirements:\n3+ years of experience in Detection Engineering, Threat Hunting, Security Analytics, MDR, Security Research, or related cybersecurity roles. \nExperience delivering security detections for products, including hands-on experience creating, implementing, and tuning detection rules in SIEM, XDR, or EDR platforms. \nExperience working with large-scale security datasets and telemetry. \nExperience with SQL, KQL, Python, or similar analytical tools. \nUnderstanding of security monitoring, detection methodologies, and investigation workflows. \nStrong understanding of attacker TTPs and the MITRE ATT&CK and ATLAS framework. \nExperience developing AI agents or AI-powered automation solutions. \nStrong analytical mindset with the ability to explore, understand, and derive insights from large-scale security datasets. \nExperience working with security telemetry across multiple domains, including endpoint, identity, cloud, email, network security, OS internals, EDR, Active Directory, Office 365, Cloud technologies such as AWS, Microsoft Azure and GCP, Network protocols and security products, including experience with security of AI infrastructure and services. \nAbility to assess data quality, identify telemetry gaps, and evaluate the feasibility and effectiveness of detection strategies. \nExperience evaluating or onboarding new security data sources and telemetry. \nExcellent written and verbal communication skills. \nPassion for cybersecurity and continuous learning. \nLab building and attack simulation experience. \nThreat Hunting experience, including hands-on IR experience - advantage. \nRed Team or penetration testing background - advantage \nExperience with Detection-as-Code methodologies, including Git-based workflows, version control, automated detection testing, and CI/CD pipelines - An advantage.","description_format":"text","description_chars":5776,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[{"name":"Israel","iso":"IL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response","Security Operations"],"lifecycle":[{"event":"open","at":"2026-10-29T13:25:55Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":0,"expected_fill_days":24,"reasons":["conf:2","velocity","win:early"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/sygnia-detection-engineer","json_url":"https://alion.io/job/sygnia-detection-engineer.json","meta":{"generated_at":"2026-10-30T23:22:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14616,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":49152},"rest":"https://alion.io/mcp/rest/get_company?id=49152"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsygnia-detection-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsygnia-detection-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsygnia-detection-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sygnia-detection-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsygnia-detection-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3459743}},{"tool":"search_jobs","arguments":{"company":"sygnia.co","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3459743},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}