[All remote jobs](https://jobicy.com/jobs.md)[![Instacart logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/fe39c2bc9bb5ebb0b5e24318b1f3b60d.jpeg)](https://jobicy.com/company/instacart.md)[Instacart](https://jobicy.com/company/instacart.md) # Detection Engineer II AI Summary Instacart seeks a Detection Engineer II to develop, tune, document, and operate security detections across endpoint, cloud, container, and SaaS telemetry. The role covers the full detection lifecycle, including forensic investigation support, telemetry quality optimization, threat hunting, and SOAR-based response automation. The engineer will use detection-as-code practices such as version control, automated testing, peer review, and CI/CD deployment. Strong knowledge of attacker TTPs, zero-trust identity threats, macOS telemetry, and at least one major cloud platform is required. This is a US-remote, full-time security engineering position that collaborates closely with incident response, red team, engineering, fraud, and trust-and-safety partners.[Apply for this job](#job-application)[View company](https://jobicy.com/company/instacart.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 142k–180,500 / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceOpen levelPublished9 Nov 2026Apply before9 Dec 2026Listing views53Application actions4Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. We’re transforming the grocery industry At [Instacart](https://jobicy.com/company/instacart.md), we invite the world to share love through food because we believe everyone should have access to the food they love and more time to enjoy it together. Where others see a simple need for grocery delivery, we see exciting complexity and endless opportunity to serve the varied needs of our community. We work to deliver an essential service that customers rely on to get their groceries and household goods, while also offering safe and flexible earnings opportunities to Instacart Personal Shoppers. Instacart has become a lifeline for millions of people, and we’re building the team to help push our shopping cart forward. If you’re ready to do the best work of your life, come join our table. Instacart is a Flex First team There’s no one-size fits all approach to how we do our best work. Our employees have the flexibility to choose where they do their best work—whether it’s from home, an office, or your favorite coffee shop—while staying connected and building community through regular in-person events. [Learn more about our flexible approach to where we work.](https://www.instacart.careers/flex-first) Overview Instacart’s Detection Engineering team sits at the core of our Security organization, building and operating the systems that identify, surface, and respond to threats across one of North America’s largest grocery technology platforms. We own the full detection lifecycle, from telemetry collection and signal design to automated response, across a complex, cloud-native environment spanning endpoint, cloud, container, and SaaS. As a Detection Engineer, you’ll be a technical anchor on the team: developing high-fidelity detection logic, hunting for novel attacker techniques, and raising the bar for how we think about coverage, quality, and scale. You’ll work closely with Engineering, Red Team, Incident Response, Fraud, and Trust & Safety to ensure our detections reflect real-world adversary behavior (and not just signatures). We operate with a detection-as-code mindset: everything we build is versioned, tested, and deployed through repeatable pipelines. We care deeply about reducing noise, improving analyst efficiency through automation and SOAR, and continuously evolving our coverage as the threat landscape shifts. If you’re energized by hard forensic problems, enjoy translating attacker TTPs into durable detection logic, and want to help shape the future of a growing security function, this role is for you. About the Job * Develop, tune, document, and maintain detection logic across multiple log sources including endpoint, cloud, container, and SaaS products. * Assist in cyber forensic investigations across a variety of log sources * Optimize log ingestion pipelines and telemetry collection to ensure high-quality, actionable security data while managing volume and cost * Design and build SOAR playbooks and automation workflows to streamline detection triage, enrichment, and response actions * Mentor/knowledge share with other detection engineers on threat hunting methodologies, detection logic development, and investigation techniques About You Minimum Qualifications * 2+ years of experience in a detection engineering, incident response, or offensive security role. * Experience with 1 or more public cloud platforms (AWS, Azure, GCP) * Deep understanding of attacker TTPs across modern zero trust environments, including identity compromise, token theft, and abuse of trust boundaries * Proficient understanding of macOS internals and telemetry available to identify macOS specific threats * Experience implementing detection-as-code workflows including version control, peer review processes, automated testing, and CI/CD deployment pipelines * Basic proficiency with Python, Golang, or other programming/scripting languages * Relevant certifications: GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar Preferred Qualifications * Background in offensive security or red teaming * Knowledge of machine learning for threat detection #LI-remote Instacart provides highly market-competitive compensation and benefits in each location where our employees work. This role is remote and the base pay range for a successful candidate is dependent on their permanent work location. Please review our Flex First remote work policy [here](https://instacart.careers/flex-first/). Offers may vary based on many factors, such as candidate experience and skills required for the role. Additionally, this role is eligible for a new hire equity grant as well as annual refresh grants. Please read more about our benefits offerings [here](https://instacart.careers/taste-of-instacart/). For US based candidates, the base pay ranges for a successful candidate are listed below. CA, NY, CT, NJ $171,000—$180,500 USD WA $164,000—$173,000 USD OR, DE, ME, MA, MD, NH, RI, VT, DC, PA, VA, CO, TX, IL, HI $157,000—$165,500 USD All other states $142,000—$150,000 USD Show more [Apply now >](https://jobicy.com/jobs/160025-detection-engineer-ii.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 4/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 4/5GuidedFull ownership ### Communication Load 4/5IndependentCollaborative AI insightThe role requires practical detection-engineering expertise across several complex environments, including macOS, public cloud, containers, and SaaS. It also demands independent technical judgment to translate evolving adversary behavior into reliable, low-noise detections and automated response workflows. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$161,250US market range (per year)$145k–$185k0$203.50k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer discloses US base-pay ranges of $142,000–$180,500 USD, varying by permanent work location. The annual cadence is inferred from the scale and context of a full-time US security engineering base salary, rather than explicitly stated. Estimated US market base pay for a Detection Engineer II is $145,000–$185,000 USD per year; equity and annual refresh grants are separate from base pay. ## Core skills Skills and capabilities most closely associated with this opportunity. [Detection engineering](https://jobicy.com/jobs?search_keywords=Detection%20engineering.md)[Threat hunting](https://jobicy.com/jobs?search_keywords=Threat%20hunting.md)[Incident response](https://jobicy.com/jobs?search_keywords=Incident%20response.md)[Digital forensics](https://jobicy.com/jobs?search_keywords=Digital%20forensics.md)[Cloud security](https://jobicy.com/jobs?search_keywords=Cloud%20security.md)[AWS](https://jobicy.com/jobs?search_keywords=AWS.md)[Microsoft Azure](https://jobicy.com/jobs?search_keywords=Microsoft%20Azure.md)[Google Cloud Platform](https://jobicy.com/jobs?search_keywords=Google%20Cloud%20Platform.md)[macOS security](https://jobicy.com/jobs?search_keywords=macOS%20security.md)[Detection as code](https://jobicy.com/jobs?search_keywords=Detection%20as%20code.md)[SOAR automation](https://jobicy.com/jobs?search_keywords=SOAR%20automation.md)[Security telemetry](https://jobicy.com/jobs?search_keywords=Security%20telemetry.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[Golang](https://jobicy.com/jobs?search_keywords=Golang.md)[CI/CD pipelines](https://jobicy.com/jobs?search_keywords=CICD%20pipelines.md) Sample interview questionsHow would you turn a newly observed identity-token theft technique into a production detection?I would first map the technique to its relevant ATT&CK behaviors and identify the telemetry needed, such as identity-provider, endpoint, cloud audit, and session logs. I would develop and test an initial analytic against representative benign and malicious activity, add context such as unusual device, IP, session, or privilege signals, then deploy it through the detection-as-code pipeline. After release, I would measure fidelity, tune exclusions carefully, document response steps, and iterate based on analyst feedback. How do you reduce alert fatigue without creating meaningful detection gaps? I begin by measuring alert volume, true-positive rate, time to triage, and common benign causes. I improve fidelity through entity context, behavioral sequences, risk scoring, deduplication, and automated enrichment rather than broadly suppressing activity. Any tuning change should be peer-reviewed, tested against known attack cases, and monitored after deployment to ensure coverage is retained. What macOS telemetry would you prioritize for threat detection? I would prioritize process execution and ancestry, code-signing and notarization status, persistence mechanisms, launch agents and daemons, shell history where available, network connections, file-system events, TCC-related access, and endpoint security framework telemetry. I would use this data to identify behaviors such as unsigned execution, suspicious child processes, credential access attempts, persistence creation, and unusual outbound connections. Describe an effective SOAR workflow for a suspicious cloud-account event. A useful playbook would enrich the alert with identity, MFA, recent login, device, IP reputation, geolocation, cloud audit activity, and privilege-change context. Based on a risk threshold, it could open a case, notify the on-call analyst, revoke sessions or keys, require credential reset, and preserve relevant logs for investigation. Automated containment should include approvals or well-defined safeguards for high-impact actions. How would you optimize log ingestion while maintaining strong detection coverage? I would inventory telemetry by detection value, cost, volume, retention needs, and data quality. High-value security events should remain available with normalization and integrity checks, while noisy low-value data can be filtered, sampled only where appropriate, or retained for shorter periods. I would validate every ingestion change against detection dependencies and use coverage metrics to confirm that essential signals remain intact. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Liftoff logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c47aea9f-221.png) Liftoff Nov 9 New ### [Security Engineer, Offensive Security](https://jobicy.com/jobs/160030-security-engineer-offensive-security.md) Liftoff is a leading AI-powered performance marketing platform for the mobile app economy. Our end-to-end technology stack helps app marketers acquire and retain high-value users, while enabling publishers to maximize… * ![DeleteMe logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c26c546a-221.png) DeleteMe Nov 9 New ### [Solutions Engineer, Cyber Security](https://jobicy.com/jobs/154932-solutions-engineer-cyber-security.md) About DeleteMe: DeleteMe is the leader in proactive privacy protection. We help security teams reduce their human attack surface by continuously monitoring and removing exposed personal data (PII) from the… * ![Caylent logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/9ed8d81b-221.jpg) Caylent Nov 8 New ### [Security Engineer](https://jobicy.com/jobs/159882-security-engineer-5.md) Caylent is an AI-first cloud services company that helps organizations turn ambitious ideas into meaningful business impact. As an AWS Premier Tier Services Partner and a charter member of Anthropic’s… * ![Databricks logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/12/4e3f864ba9cf3c62d471e1c62414d098.jpg) Databricks Nov 8 New ### [Staff Enterprise Security Engineer](https://jobicy.com/jobs/159859-staff-enterprise-security-engineer.md) RDQ227R1176 While candidates in the listed location(s) are encouraged for this role, candidates in other locations (US based) will be considered. Mission Databricks is hiring an L6 Staff Enterprise Security… * ![D2L logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/0ac958a8-221.jpg) D2L Nov 8 New ### [Senior Application Security Analyst](https://jobicy.com/jobs/159850-senior-application-security-analyst.md) D2L is a cloud company that is modernizing education and building the Future of Work. The old models of teaching and learning are in the midst of the largest transformation… * ![1Password logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/09/WRILS-200909195848-296323.png) 1Password Nov 8 New ### [Senior IT Engineer, Identity and Access Management](https://jobicy.com/jobs/159753-senior-it-engineer-identity-and-access-management.md) 1Password is growing. We’ve surpassed $500M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up… * ![Goodleap logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/482c4fb7-221.png) Goodleap Nov 8 New ### [Staff Security Engineer, Security Operations](https://jobicy.com/jobs/159659-staff-security-engineer-security-operations.md) About GoodLeap: GoodLeap is a technology company delivering best-in-class financing and software products for sustainable solutions, from solar panels and batteries to energy-efficient HVAC, heat pumps, roofing, windows, and more…. * ![Discord logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/02/WRILS-210216185819-522054.jpg) Discord Nov 8 New ### [Engineering Manager, Platform Security](https://jobicy.com/jobs/154856-engineering-manager-platform-security.md) Discord has a highly engaged community of millions of daily active users who use the platform for many different reasons, but there’s one thing that nearly everyone does: play video… * ![HackerOne logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/8937d355-221.png) HackerOne Nov 8 New ### [Senior Security Engineer, Identity and Access Management](https://jobicy.com/jobs/154842-senior-security-engineer-identity-and-access-management.md) HackerOne is a global leader in Continuous Threat Exposure Management (CTEM). The HackerOne Platform unites agentic AI solutions with the ingenuity of the world’s largest community of security researchers to… * ![Elevenlabs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e01b4c5d-221.png) Elevenlabs Nov 8 New ### [Safety Engineer – Free Tier Abuse](https://jobicy.com/jobs/154823-safety-engineer-free-tier-abuse.md) About ElevenLabs ElevenLabs is an AI research and product company transforming how we interact with technology. We launched in January 2023 with the first human-like AI voice model. Today, we… [Browse all jobs](https://jobicy.com/jobs.md)