Detection and Response Engineer

🕒 July 24

🇺🇸 United States – Remote

💵 $100k - $145k / year

⏰ Full Time

🟡 Mid-level

🟠 Senior

👷🏻‍♀️ Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 15%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

North

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

💼 Consulting

🏥 Healthcare

📦 Logistics

Consulting • Healthcare • Logistics

North is a comprehensive payment solutions provider. Specializing in point of sale systems, payment processing, and merchant services, North offers a wide array of products to streamline business operations both online and offline. Their services include secure mobile payments, ecommerce gateways, POS solutions, and back-office tools such as invoicing, reporting, inventory management, and customer loyalty programs. North supports diverse industries, including retail, restaurants, healthcare, gaming, and more, with robust solutions tailored to specific business needs. They offer scalable options for enterprises and franchises and provide APIs for developers to create integrated payment solutions. Committed to security, North ensures all transactions are PCI DSS-validated with advanced encryption and tokenization.

📋 Description

• Design, build, and tune detection content across endpoint, network, cloud, and identity log sources • Perform coverage and gap analysis against MITRE ATT&CK and actual log source volume • Validate detection logic against real-world attack techniques and reduce false-positive rates • Maintain and version-control the detection rule repository, including coverage documentation and known gaps • Triage, investigate, and contain security incidents and alerts • Conduct root cause analysis and structured post-incident reviews • Document incident timelines, indicators of compromise, and remediation actions • Support forensic investigations of compromised hosts, accounts, and applications • Participate in an on-call rotation for critical incident response as needed • Evaluate, pilot, and implement AI/LLM-powered tools for alert triage, enrichment, and analyst workflows • Build and tune AI-assisted investigation and detection workflows to reduce analyst workload and MTTR • Identify high-value AI and automation use cases and measure impact • Apply human validation to AI-generated output where necessary, especially for high-confidence detections and containment actions • Develop SOAR, script, and API-based automation for detection, enrichment, and response workflows • Automate repetitive SOC and incident response tasks, including evidence gathering, enrichment, and ticketing • Build and maintain playbooks and runbooks for common incident types • Write and maintain Python or similar scripts integrating security tools and data sources • Partner with cloud, network, and identity teams to close visibility and telemetry gaps • Stay current on threat intelligence, adversary TTPs, and vulnerabilities relevant to payments/fintech • Communicate findings, coverage gaps, and recommendations to technical and non-technical stakeholders • Develop and maintain procedure and policy documentation supporting detection and response operations

🎯 Requirements

• Bachelor's degree in a technical field, or equivalent professional experience • 3–5 years of hands-on information security experience, with demonstrated depth in at least two of: detection engineering, incident response, security automation, or SOC operations • Hands-on experience writing, tuning, or maintaining detection content in a SIEM or NG-SIEM platform, such as CrowdStrike NG-SIEM, Splunk, or Microsoft Sentinel • Experience with EDR/XDR platforms and log analysis across endpoint, network, cloud, and identity sources • Working knowledge of the MITRE ATT&CK framework and practical application to detection engineering and gap analysis • Scripting or automation experience using Python, PowerShell, or similar applied to security use cases and/or experience using LLM coding tools such as Claude Code, Gemini CLI, or Codex • Solid understanding of networking, cloud infrastructure (AWS especially, plus Azure and GCP), Windows/Linux systems, and identity platforms • Working knowledge of PCI-DSS or a comparable compliance framework • Excellent written and verbal communication skills, including translating technical findings for non-technical stakeholders • Applicants located in the East and Central time zones receive preferred consideration • Must be eligible to work in the United States; no current or future sponsorship available • Certifications including GCIH, GCFA, OSCP, OSIR, CompTIA CySA+, or CompTIA CASP+ are nice to have, but not required • Relevant hands-on experience is weighted more heavily than certifications • SOAR platform experience, such as N8N or Tines, is beneficial • Experience integrating or building with LLM/AI APIs for security use cases is beneficial • Experience with cloud-native security tooling, threat intelligence platforms, digital forensics, purple team/adversary emulation, and payments/fintech regulatory environments is beneficial

🏖️ Benefits

• Total rewards offerings • Benefits supporting overall well-being • Unique personally and professionally fulfilling initiatives • Diverse and inclusive work environment