Senior Detection Engineer

About ActiveCampaign: ActiveCampaign is the autonomous marketing platform for people at the heart of the action. It empowers teams to automate their campaigns with AI agents that imagine, activate, and validate–freeing them from step-by-step workflows and unlocking limitless ways to orchestrate their marketing. With AI, goal-based automation, and 1,000+ app integrations, agencies, marketers, and owners can build cross-channel campaigns in minutes–fine-tuned with billions of data points to drive real results for their unique business. ActiveCampaign is the trusted choice to help businesses unlock a new world of boundless opportunities–where ideas become impact and potential turns into real results. As a global multicultural company, we are proud of our inclusive culture which embraces diverse voices, backgrounds, and perspectives. We don’t just celebrate our differences, we believe our diversity is what empowers our innovation and success. You can find out more about our DEI initiatives here. Perks and benefits: At ActiveCampaign, we prioritize employees’ well-being and professional growth by cultivating a culture centered on collaboration and innovation. When you join our team, you’ll not only have the opportunity to make a significant impact, but also enjoy a range of benefits tailored to support your personal and career development. Here are some of the benefits we offer: -Comprehensive Health & Wellness: Top-tier benefits package that includes a fully-covered High Deductible Health Plan (HDHP), complimentary access to telehealth services, and a free subscription to Calm. -Growth & Development: Access to LinkedIn Learning, professional development programs, and career growth opportunities in a fast-growing organization. -Generous Paid Time Off: Recharge and take the time you need to maintain work-life balance with open PTO. -Total Rewards: Generous 401(k) matching with immediate vesting, quarterly perks with commuter and lunch benefits for hub based employees or a stipend for remote workers, and a four-week paid sabbatical with bonus after five years. -Collaborative Culture: Work alongside brilliant, passionate colleagues in an environment that values innovation, teamwork, and mutual support. ActiveCampaign is an equal opportunity employer. We recruit, hire, pay, grow and promote no matter of gender, race, color, sexual orientation, religion, age, protected veteran status, physical and mental abilities, or any other identities protected by law. Our Employee Resource Groups (ERGs) strive to foster a diverse inclusive environment by supporting each other, building a strong sense of belonging, and creating opportunities for mentorship and professional growth for their members. On a typical day, you might: Design and deploy sophisticated detection logic across our entire technology stack using detection-as-code principles like YARA-L, Sigma, and KQL. Build automated response workflows that independently enrich, triage, and remediate security alerts, effectively eliminating manual toil through advanced SOAR principles. Investigate complex security signals —such as novel attack patterns or phishing campaigns—that require deep human judgment and strategic intuition. Collaborate cross-functionally with DevOps and Security Engineering teams to adapt detection logic to infrastructure changes before security blind spots can emerge. Leverage AI and LLMs as force multipliers to accelerate threat hunting, generate new detection hypotheses, and automate repetitive investigative tasks. Lead post-incident reviews with engineering partners, transforming security findings into preventative architectural changes that harden our long-term defense. Prototype and test emerging detection capabilities and data sources, ensuring we stay ahead of the threat landscape while participating in an on-call rotation to defend our most critical systems. What is needed: 5+ years of hands-on experience in detection engineering, incident response, or security operations within high-growth technology environments. Advanced programming proficiency in Python , with a proven ability to build production-quality security automations and custom integrations from scratch. Deep expertise in Cloud Security (AWS) , including a comprehensive understanding of IAM, VPC, CloudTrail, and Lambda attack vectors. Mastery of detection logic in at least two major languages, such as YARA-L, Sigma, KQL, or SPL. A track record of building SOAR workflows or equivalent automation platforms that measurably reduce operational overhead at scale. Exceptional communication skills , with the ability to distill complex security risks into actionable insights and influence technical decisions across the organization. Experience using AI/LLMs as a strategic tool for threat analysis, investigation automation, and increasing the velocity of security work. A self-directed, engineering-first mindset , ideally with a background in SRE, DevOps, or platform engineering and a history of contributing to open-source security projects.

{
  "content_hash": "50db1fb37818bdf37e812b4666fa5b2b7d2afb4ead98e76e9f70a1b3edde6ab6",
  "source_hash": "4b3830d0569b670495e50af644193c07670c1788e00853ec84fd8fcee7252486",
  "last_changed_at": "2026-06-09T07:55:27.097Z",
  "active_status": "active"
}

{
  "language": "en",
  "location": {
    "raw": "United States",
    "city": null,
    "region": null,
    "country": "United States",
    "is_remote": true,
    "confidence": 0.95
  },
  "salary_max": 154000,
  "salary_min": 126000,
  "inferred_at": "2026-06-19T07:55:40.288Z",
  "launch_scope": {
    "reason": "english_us_canada",
    "included": true,
    "language": "en",
    "location": {
      "raw": "United States",
      "city": null,
      "region": null,
      "country": "United States",
      "is_remote": true,
      "confidence": 0.95
    },
    "countries": [
      "United States"
    ]
  },
  "remote_policy": "remote",
  "salary_period": "year",
  "workplace_type": "remote",
  "salary_currency": "USD"
}

{}

{
  "lists": [
    {
      "text": "On a typical day, you might:",
      "content": "\n<li><strong>Design and deploy</strong> sophisticated detection logic across our entire technology stack using detection-as-code principles like YARA-L, Sigma, and KQL.</li>\n<li><strong>Build automated response workflows</strong> that independently enrich, triage, and remediate security alerts, effectively eliminating manual toil through advanced SOAR principles.</li>\n<li><strong>Investigate complex security signals</strong>—such as novel attack patterns or phishing campaigns—that require deep human judgment and strategic intuition.</li>\n<li><strong>Collaborate cross-functionally</strong> with DevOps and Security Engineering teams to adapt detection logic to infrastructure changes before security blind spots can emerge.</li>\n<li><strong>Leverage AI and LLMs</strong> as force multipliers to accelerate threat hunting, generate new detection hypotheses, and automate repetitive investigative tasks.</li>\n<li><strong>Lead post-incident reviews</strong> with engineering partners, transforming security findings into preventative architectural changes that harden our long-term defense.</li>\n<li><strong>Prototype and test</strong> emerging detection capabilities and data sources, ensuring we stay ahead of the threat landscape while participating in an <strong>on-call rotation</strong> to defend our most critical systems.</li>\n"
    },
    {
      "text": "What is needed:",
      "content": "\n<li><strong>5+ years of hands-on experience</strong> in detection engineering, incident response, or security operations within high-growth technology environments.</li>\n<li><strong>Advanced programming proficiency in Python</strong>, with a proven ability to build production-quality security automations and custom integrations from scratch.</li>\n<li><strong>Deep expertise in Cloud Security (AWS)</strong>, including a comprehensive understanding of IAM, VPC, CloudTrail, and Lambda attack vectors.</li>\n<li><strong>Mastery of detection logic</strong> in at least two major languages, such as YARA-L, Sigma, KQL, or SPL.</li>\n<li><strong>A track record of building SOAR workflows</strong> or equivalent automation platforms that measurably reduce operational overhead at scale.</li>\n<li><strong>Exceptional communication skills</strong>, with the ability to distill complex security risks into actionable insights and influence technical decisions across the organization.</li>\n<li><strong>Experience using AI/LLMs</strong> as a strategic tool for threat analysis, investigation automation, and increasing the velocity of security work.</li>\n<li>A <strong>self-directed, engineering-first mindset</strong>, ideally with a background in SRE, DevOps, or platform engineering and a history of contributing to open-source security projects.</li>\n"
    }
  ],
  "country": "US",
  "createdAt": 1770402992501,
  "updatedAt": null,
  "categories": {
    "team": "Security",
    "location": "United States",
    "commitment": "Full-time",
    "department": "Security",
    "allLocations": [
      "United States"
    ]
  },
  "salaryRange": {
    "max": 154000,
    "min": 126000,
    "currency": "USD",
    "interval": "per-year-salary"
  },
  "workplaceType": "remote"
}