[Hiring] Detection & Response Engineer @MARS SECURITY

Role Description

Mars Security is looking for a Detection & Response Engineer who builds detections that fire on real attacks and knows what to do when they do. This role sits at the intersection of detection engineering, incident response, and threat hunting. You will design, test, and tune detection logic across real customer environments, investigate what it surfaces, and turn every finding into better coverage. You will work directly with founders and directly with customers. What you build shapes the product.

If you look at an alert queue and think about which attacks it would never catch, you should be talking to us.

What You'll Do

• Design, build, and validate detection rules across SIEM, EDR, cloud, identity, etc.
• Map detection coverage against attacker TTPs and active campaigns, and close the gaps that matter.
• Tune detections to cut noise and false positives without losing signal.
• Investigate and triage alerts and suspicious activity, and support incident response in customer environments.
• Run hunts to find what existing detections miss, and turn findings into new detection content.
• Build response playbooks and automation that shorten time from detection to containment.
• Contribute to the platform by defining what good detection and response looks like at scale.

Qualifications

• 5+ years hands-on experience in SOC, threat hunting, or detection engineering - MUST.
• Detection engineering experience: you've written rules that caught real attacks, not just passed tests.
• Incident response experience: investigation, scoping, containment, and root cause.
• Strong query skills across detection languages (SPL, KQL, Sigma, YARA, etc.).
• Solid understanding of attacker TTPs, MITRE ATT&CK, and how campaigns operate end to end.
• Familiarity with infrastructure: networking, identity, cloud, endpoint. You know where attackers hide because you know how the plumbing works.
• Python proficiency for scripting, automation, and analysis.
• Experience with detection-as-code, CI/CD for detections, or SOAR - a plus.
• Malware analysis, threat intelligence, or red team background is a strong plus.
• Excellent written and verbal English communication skills.
• Strong customer-facing skills and ability to build trusted relationships with customers.
• Team player with strong collaboration and communication skills.

Benefits

• Ground-floor opportunity at a well-funded, fast-growing cybersecurity company.
• Direct access to founders and meaningful influence on the product roadmap.
• Deep exposure to adversary research and real-world detection engineering at scale.
• Work alongside a team built from offensive security and threat intelligence practitioners.