Senior Security Engineer, Detection Engineering

NVIDIA is a technology company seeking a Senior Security Engineer to join its Detection and Automation Engineering team. The role focuses on building, validating, deploying, and maintaining high-confidence security detections across enterprise, cloud, identity, endpoint, developer, AI, and production environments while partnering with incident response, threat intelligence, and security operations teams.

Responsibilities:

• Build and tune high-confidence detections across platforms such as Splunk, Microsoft Sentinel / Defender, CrowdStrike, cloud-native logs, identity telemetry, endpoint data, SaaS platforms, and developer systems
• Translate incidents, hunts, threat intelligence, red-team findings, and vulnerability context into detection logic we can test and operate
• Investigate real telemetry before we alert on it, including field behavior, timing, joins, baselines, and the false positives a responder will actually see
• Drive the full detection lifecycle: design, query development, validation, peer review, documentation, deployment, tuning, monitoring, and retirement
• Strengthen detection-as-code workflows, including test data, quality checks, metadata, rollout safety, coverage tracking, and detection health reporting
• Partner with responders to cut noise, add useful context, improve severity decisions, and build follow-up detections after investigations
• Shape logging, normalization, enrichment, and retention requirements when the telemetry we need is missing or hard to use
• Coach analysts and engineers through design reviews, query reviews, and clear guidance on what makes a detection credible

Requirements:

• 8+ years of experience in detection engineering, security engineering, threat hunting, incident response, SOC engineering, or information security monitoring
• A degree in Computer Science, Cybersecurity, Engineering, or equivalent experience
• Hands-on experience building and tuning detections in a major SIEM or security analytics platform
• Strong query and scripting skills, especially SPL, KQL, SQL, Python, or similar languages used to analyze security telemetry and automate repetitive work
• Practical understanding of attacker behavior across identity, endpoint, cloud, network, email, collaboration tools, developer infrastructure, secrets, and data theft
• Ability to move from raw logs to a production-ready detection, including field semantics, thresholds, joins, baselines, false positives, missing data, and triage context
• Comfortable working with Git, code review, automated checks, CI/CD, documentation, and operational ownership of the content you ship
• Clear communication and sound judgment. You should be able to explain why a detection matters, what it misses, what we should do next, and when we should choose not to alert
• You have led or materially improved a detection-as-code program across more than one security platform
• Background in cloud, identity, Kubernetes, CI/CD, supply-chain, or AI-tooling attack paths well enough to design detections without waiting for a complete recipe
• Detected abuse in developer systems, package ecosystems, secrets workflows, AI coding tools, agents, bots, or model-serving infrastructure
• Worked closely with incident response, threat hunting, red team, purple team, malware analysis, or forensics teams
• Built validation methods such as replay tests, synthetic telemetry, attack emulation, detection unit tests, or coverage reporting