Security Detection Engineer

Builds WHOOP's detection engineering programme, reporting to the Information Security Manager in Boston and protecting the biometric and health data of millions of members. The engineer writes detections as code across cloud, identity, endpoint, network and application layers mapped to MITRE ATT&CK, focusing on account takeover, credential and API abuse, privilege escalation and exfiltration, validates them through adversary emulation, tunes and enriches alerts, tracks detection KPIs, and leads incident investigations.

It asks for four years in security with a focus on detection, experience with SIGMA, YARA or Suricata, cloud and SaaS telemetry, and Python, Go or PowerShell; ML for triage is a plus.