Detection Engineer – Product Security

Our mission is to help people integrate technology into everyday life and to enable innovation through technology. We offer software development and infrastructure solutions, with advanced competences in Blockchain, Artificial Intelligence and Machine Learning. All our offices (in Western Europe or nearshore, in CEE) are located within the boundaries of the European Union. We believe working in close cooperation with our clients and employees is the key to success; this means we offer people the best working environment in order to achieve the best results. We love entrepreneurial spirits and encourage people around us to be proactive and make the best decisions not only for business, but for their own personal development. Our nearshore Romanian offices are in Bucharest (Victoriei Square) and Iasi (Palace) and, with over 9000 team members at group level, we make sure we are always close to our customers.

About the role:

We are looking for a Detection Engineer to join a Product Security initiative focused on building and improving security detection and response capabilities across web and mobile applications, APIs and supporting services.

This is an engineering-focused role, with an emphasis on building custom detection capabilities rather than only investigating alerts or operating existing security tools.

You will work with security and application data collected in SIEM, develop custom detection logic, improve telemetry and contribute to AI-assisted alert triage and controlled response automation.

The team has already started building the foundations of this detection capability, and the new engineer will help expand and mature the solution.

What you will be working on:

• Custom security detections and anomaly detection capabilities.
• SIEM data, security analytics and application telemetry.
• Detection coverage for Account Takeover, automated abuse, unusual traffic, enumeration and access-control failures.
• Authentication and session misuse detection.
• Detection of suspicious access to sensitive information.
• AI-assisted alert triage.
• AI agents and LLM-powered security workflows.
• Incident workflows and response playbooks.
• Controlled security response automation.
• Event schemas, logging quality and telemetry coverage.
• Detection performance, false positives and alert noise reduction.

What you will do:

• Build, test and tune security detections and anomaly detection jobs.
• Develop and maintain custom detection logic on top of SIEM data.
• Use version control, backtesting and staged releases to ensure detection reliability.
• Identify application events, signals and data fields required for effective security detection.
• Work with application and platform teams to improve logging, telemetry and data quality.
• Build and improve AI-assisted triage capabilities.
• Develop AI agent workflows, tool integrations, context enrichment and escalation logic.
• Measure detection and AI decision quality and continuously improve the solution.
• Build incident workflows and response playbooks.
• Introduce response automation in controlled stages.
• Implement appropriate human approvals, monitoring, auditability, failure handling and rollback.
• Investigate detection failures and use responder feedback to improve coverage.
• Collaborate closely with Security, Engineering and Platform teams.

Requirements:

• Strong professional experience in Security Engineering, Detection Engineering, Product Security or a related technical security area.
• Practical experience with SIEM, security analytics, detection development or alert tuning.
• Experience building or significantly modifying security detections.
• Strong understanding of web, mobile and/or API security threats.
• Good understanding of logging, event schemas, telemetry and data quality.
• Hands-on coding experience with Python, Go, Java or a similar programming language.
• Experience building automation or custom security tooling.
• Experience working with production software or security systems.
• Strong engineering mindset and ability to build custom capabilities rather than only operate existing security products.
• Strong troubleshooting and problem-solving skills.
• Ability to work independently and take ownership of technical topics.
• Strong communication and collaboration skills in an international environment.

Nice to Have:

• Hands-on experience building, integrating or extending AI agents or LLM-powered applications.
• Experience with tool-calling workflows and agent orchestration.
• Experience with context enrichment, retrieval or LLM evaluation.
• Experience with behavioral analytics or anomaly detection.
• Machine Learning knowledge.
• Security orchestration and response automation experience.
• Incident Response or containment playbook experience.
• Web or mobile Application Security testing experience.
• Infrastructure as Code knowledge.
• CI/CD experience.
• Experience developing internal security tooling or custom detection frameworks.
• Relevant AI experience gained through professional, academic, research or technically substantial personal projects.

Once on board we offer various programs and benefits:

• 22 working days as Annual Vacation plus 3 additional days off.
• Floating days
• Medical Insurance at Signal Iduna.
• Benefit Online platform access, with a 690 RON monthly allowance from which you can choose to invest in different wellbeing, financial or retail packages.
• Company performance-based annual bonus prorated according to the number of worked months in a year
• Financial support for the birth of your child or unhappy events.
• Learning and development opportunities - allocated budget for certifications and/or trainings.