{"id":3545330,"url":"https://alion.io/job/vulncheck-detection-and-response-engineer-uk","title":"Detection and Response Engineer - UK","company":{"id":42912,"name":"VulnCheck","domain":"vulncheck.com","url":"https://alion.io/company/vulncheck","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":["GB"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":83000,"max_usd":147000,"period":"year","method":"role_seniority_country_cell","sample_n":42},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"CVE","optional":false},{"name":"ETL/ELT","optional":false},{"name":"KEV","optional":false},{"name":"LLM","optional":false},{"name":"Nuclei","optional":true},{"name":"Snort","optional":true},{"name":"Suricata","optional":true},{"name":"Zeek","optional":true}],"status":"live","first_seen_at":"2026-10-30T18:04:22Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-03T18:07:58Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"Senior Detection and Response Engineer (Cheltenham, UK)\nLocation: Cheltenham, UK\nTeam: Product & Engineering\nEmployment Type: Full-Time, Remote\nAbout VulnCheck\nExploitation prevention is only as strong as the intelligence driving those efforts, and most of the industry is still running on intelligence that lacks exploit context. VulnCheck, The exploit intelligence company, delivers structured exploit intelligence on what is actively weaponized in the wild, purpose-built for the data lakes, ETL pipelines, automation, and AI and LLM workflows your infrastructure already runs on, raising the capability of everything it powers.\nAbout the Role\nOur Target and Canary Intelligence products provide unique visibility into vulnerable assets on the internet, attacker infrastructure, and attacks that leverage vulnerabilities for initial access. Target Intelligence maintains a continuously updated view of internet-facing systems - the services and versions they run, and their exposure to vulnerabilities. Canary Intelligence deploys intentionally vulnerable systems across the internet and captures real exploitation attempts as they happen.\nWe are looking for an experienced detection and response engineer to help scale the durable detections behind these products. These detections generate world-class, vulnerability-centric threat intelligence our customers rely on to defend themselves against exploitation activity on the internet.\nYou'll have wide latitude to shape how VulnCheck stays ahead of an accelerating volume of vulnerabilities - the tooling, the workflows, and the standards for detection engineering at scale. Although this is a 100% remote role, candidates must be located in or around Cheltenham, United Kingdom.\nWhat You'll Do\nDesign and direct AI-assisted, agentic detection workflows that scale coverage to an accelerating volume of vulnerabilities, with you on the loop for quality\nAuthor and ship network signatures and detections against internet-scale scan and probe data to identify services, versions, and whether hosts are vulnerable.\nBuild detections against Canary telemetry that separate real exploitation signal from internet noise, and synthesize that signal into threat intelligence customers can act on\nDrive feedback loops into our probing and collection capabilities - identifying what data we should collect, what we shouldn't, and where coverage gaps exist\nContinuously evaluate detection quality, measuring and tuning false positive and false negative rates\nRespond rapidly when high-impact vulnerabilities drop - analyze, build coverage, ship\nWork alongside our vulnerability researchers and threat hunters to connect detection engineering with exploit intelligence\nWhat You'll Bring\n5+ years of experience building and shipping durable detections over network and host data\nExperience scaling detection development and continuous evaluation processes using AI and agentic workflows with humans on the loop\nA track record of researching, engineering, and validating durable detections across network and host telemetry, with a disciplined approach to false positives and false negatives\nExpertise in device fingerprinting and protocol analysis. You understand the nuances of how services manifest on the wire, and how these signals stack to passively uncover what is running behind an open port on an internet address\nKnowledge of attacker command-and-control techniques, covert channels, and exploitation artifacts - and how to identify them through network traffic analysis\nA background in host-based analysis and DFIR. You know what telemetry is worth collecting from sensors to identify exploitation activity and attacker behaviors, and how to synthesize it into high-quality, actionable threat intelligence\nStrong programming or scripting ability - you can codify detection logic so it is performant and integrates cleanly with VulnCheck’s engineering system\nFamiliarity with CVE, NVD, KEV, or exploit intelligence datasets\nA response mindset - when a new vulnerability drops, you're the first to dig in, analyze it, and ship detection coverage\nPreferred Qualifications\nExperience developing and tuning detections in Suricata, Snort, Zeek, or similar, and writing Nuclei templates or other scanner signatures\nPublished detection research, signatures, or open-source detection content\nExperience with streaming systems or real-time data processing\nBackground in high-growth or startup environments\nWhy Join Us\nBuilt on over two decades of cybersecurity experience, our team of experts understands the intricacies of vulnerabilities, their exploitation in the wild, and how to leverage this data to build more effective cybersecurity products that produce better outcomes for organizations.\nVulnCheck gives organizations a tactical advantage by providing best-in-class exploit & vulnerability intelligence information. We have a sense of duty to protect the critical infrastructure we rely on including medical devices, power grids and telecommunication networks. We were founded in 2021 in Lexington, Massachusetts.\nVulnCheck has a transparent, collaborative, and supportive culture - we are looking for people who have a growth mindset, are curious and innovative. Our team is smart, but humble, hardworking, and supportive.\nVulnCheck is proud to be an Equal Employer Opportunity employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. VulnCheck is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities. Even if your experience doesn't perfectly align with the job description, we encourage you to apply - we value potential just as much as a perfect resume.","description_format":"text","description_chars":5963,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Vulnerability Management"],"lifecycle":[{"event":"open","at":"2026-10-30T20:35:53Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":3,"expected_fill_days":62,"reasons":["conf:2","win:early"],"computed_at":"2026-11-03T05:54:40Z"},"pay":null,"html_url":"https://alion.io/job/vulncheck-detection-and-response-engineer-uk","json_url":"https://alion.io/job/vulncheck-detection-and-response-engineer-uk.json","meta":{"generated_at":"2026-11-03T21:34:57Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":880,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":42912},"rest":"https://alion.io/mcp/rest/get_company?id=42912"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fvulncheck-detection-and-response-engineer-uk"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fvulncheck-detection-and-response-engineer-uk"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fvulncheck-detection-and-response-engineer-uk"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/vulncheck-detection-and-response-engineer-uk\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fvulncheck-detection-and-response-engineer-uk"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3545330}},{"tool":"search_jobs","arguments":{"company":"vulncheck.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3545330},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}