engineering
Posted Apr 16Senior Detection Engineer (SIEM / Security Observability)
at Keeper.app
United StatesHybrid
Responsibilities
- Design, build, and maintain detection and telemetry capabilities across Datadog, SentinelOne, and Wiz
- Develop, test, and tune high-fidelity detection rules aligned to real-world attack scenarios and adversary behaviors
- Continuously improve alert quality by reducing false positives, eliminating noise, and increasing detection accuracy
- Implement and mature detection-as-code practices for scalable, version-controlled, and testable rule management
- Define and enforce logging, telemetry, and instrumentation standards across cloud infrastructure, applications, endpoints, and identity systems
- Build and optimize log ingestion, parsing, normalization, enrichment, and retention pipelines
- Automate onboarding of new data sources and improve telemetry coverage across production and corporate environments
- Correlate signals across SIEM, EDR, cloud, identity, and security tooling to improve detection depth and investigation quality
- Build dashboards, analytics, and reporting that support operational decision-making across Security, SRE, and Engineering
- Map and maintain detection coverage against MITRE ATT&CK and help identify visibility gaps
- Perform detection gap assessments and evolve use cases based on threat intelligence, threat hunting, and emerging risks
- Collaborate with cloud, infrastructure, product, and compliance teams to strengthen secure logging and observability patterns throughout the software development lifecycle Requirements 5–8+ years of
- Manage interviews and recruitment workflow
- Lodge a complaint with your data protection authority
Requirements
- Its core offering, KeeperPAM®, is an AI-enabled, cloud-native platform that protects all users, devices and infrastructure from cyber attacks.
- experience in detection engineering, SIEM engineering, security engineering, or security observability Hands-on
- experience with SIEM, security analytics, or observability platforms, such as Datadog, SentinelOne, Splunk, Microsoft Sentinel, Elastic, or similar tools •
- Strong understanding of security telemetry across cloud, endpoint, identity, and application environments •
- Experience with log parsing, normalization, enrichment, and pipeline management
- Strong knowledge of cloud environments, with AWS preferred
- Proficiency in scripting or automation using Python, PowerShell, or similar
- Solid understanding of modern detection strategies, attacker behaviors, and the MITRE ATT&CK framework
- Ability to work cross-functionally with Security Operations, Engineering, Infrastructure, and SRE teams Preferred
- Experience with Datadog Cloud SIEM, SentinelOne, Wiz, or similar modern security platforms •
- Experience with observability concepts including logs, metrics, traces, and instrumentation •
- Experience with SOAR, workflow automation, or response orchestration
- Familiarity with Sigma or other detection-as-code frameworks •
- Experience in high-scale SaaS, cloud-native, or security product environments
- Familiarity with zero-trust architectures, identity-centric security, and privileged access management Benefits
- Providing this information is optional and Keeper collects this data in order to comply with EEOC and similar requirements
Benefits
- Medical, Dental & Vision (inclusive of domestic partnerships)
- Employer Paid Life Insurance & Employee/Spouse/Child Supplemental life
- Voluntary Short/Long Term Disability Insurance
- 401K (Roth/Traditional)
- A generous PTO plan that celebrates your commitment and seniority (including paid Bereavement/Jury Duty, etc)
- Above market annual bonuses
Contact
- Learn why Keeper is trusted by leading organizations to defend against modern adversaries at KeeperSecurity.com . About the Job
Additional details
- Keeper Security is seeking a Senior Detection Engineer to advance detection engineering, SIEM operations, and security telemetry across a globally distributed, cloud-native environment.
- This is a 100% remote position, with an opportunity to work a hybrid schedule for candidates based in the El Dorado Hills, CA or Chicago, IL metro areas.
- Keeper’s cybersecurity software is trusted by millions of people and thousands of organizations globally.
- Keeper is published in 23 languages and sold in over 150 countries.
- Join one of the fastest-growing cybersecurity companies and help advance Keeper’s security visibility, detection maturity, and operational readiness. About Keeper
- Keeper Security is one of the fastest-growing cybersecurity software companies that protects thousands of organizations and millions of people in over 150 countries.
- Keeper is a pioneer of zero-knowledge and zero-trust security built for any IT environment.
- As a Senior Detection Engineer, you will build and operate the detection and telemetry capabilities that power security visibility across Keeper’s production and corporate environments.
- This role is focused on SIEM engineering, detection logic, alert tuning, telemetry quality, and security observability.
- You will partner closely with Security Operations, Infrastructure, SRE, and Engineering teams to ensure logs, metrics, traces, and endpoint signals are actionable, scalable, and aligned to real-world threat scenarios.