Detection Engineer - Security & Automation | Instacart

As a Detection Engineer on the Security team, you will sit at the core of Instacart's defense architecture, building and operating the systems that identify, surface, and respond to threats across cloud-native environments spanning endpoints, containers, and SaaS products. Operating with a detection-as-code mindset, you will write versioned, automated detection logic, optimize log ingestion pipelines, hunt for novel adversary techniques, and partner across Red Team, Incident Response, Fraud, and Trust & Safety teams to translate real-world TTPs into durable security logic.

Key Responsibilities

Detection Engineering & Threat Hunting

• Detection Logic Development: Develop, tune, document, and maintain high-fidelity detection logic across diverse telemetry sources (endpoint, cloud, container, and SaaS).
• Detection-as-Code Pipelines: Implement and enforce detection-as-code workflows using version control, peer reviews, automated testing, and CI/CD deployment pipelines.
• Threat Hunting & Tactics Analysis: Translate real-world attacker TTPs into durable detection signals, focusing on zero-trust threats, identity compromises, token theft, and boundary abuses.

Security Automation & Telemetry

• SOAR & Playbook Automation: Design and build SOAR playbooks and automated workflows to streamline alert enrichment, triage, and rapid incident response actions.
• Log Ingestion & Telemetry Optimization: Optimize log ingestion pipelines and telemetry collection to maximize actionable security data while managing volume and infrastructure costs.
• Forensic Investigations: Assist in cyber forensic investigations and incident response across multi-cloud and macOS endpoint log sources.
• Knowledge Sharing & Mentorship: Mentor fellow detection engineers on threat hunting methodologies, detection logic best practices, and investigative techniques.

Requirements

Technical Depth & Security Engineering Foundations

• Experience Track: 2+ years of hands-on experience in a detection engineering, incident response, or offensive security role.
• Cloud Platform Expertise: Practical experience operating with at least one major public cloud platform (AWS, Azure, or GCP).
• Attacker TTP Mastery: Deep understanding of modern adversary tactics in zero-trust environments, including identity compromises, token theft, and trust boundary exploitation.
• macOS Security: Proficient understanding of macOS internals and available telemetry to detect macOS-specific threats.
• Detection-as-Code Workflow: Experience building version-controlled detection pipelines with automated testing and CI/CD integration.
• Scripting & Automation: Basic proficiency in Python, Golang, or other relevant programming/scripting languages.
• Relevant Certifications: Possess industry certifications such as GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar credentials.

Preferred Qualifications

• Professional background in offensive security, red teaming, or penetration testing.
• Exposure to or knowledge of applying machine learning for automated threat detection and anomaly detection.

Total Rewards & Benefits

• Market-Competitive Pay: State-adjusted US base salary ($142,000 – $180,500 USD) + new hire equity grants + annual refresh grants.
• Flex First Remote Work: Complete location flexibility with remote work setup support and regular team events.
• Health & Wellbeing: Comprehensive medical, dental, and vision health coverage options for employees and eligible dependents.
• Growth & Learning: Mentorship programs, continuous skill-building, and professional development support.