Detection Engineer II
Instacart · Canada
What the posting says
Each fact carries its state:Statedfound in the postingConflictstwo statements disagree, both quotedNot mentionedthe posting does not say
- PayStated
- $145,000–$153,000 a year
- Employment typeStated
- Full time
- Work arrangementStated
- Remote OK
- ExperienceStated
- 2-5 years
- EducationStated
- ['professional certificate']
Not mentioned in this posting
“Not mentioned” means the posting does not say. It is not a no. You could ask the recruiter.
- ShiftNot mentioned
- The posting does not say
- Visa sponsorshipNot mentioned
- The posting does not say
Requirements, each with its sentence from the posting
These are the employer’s words. The index does not judge whether you meet them.
- Detection engineering, incident response or offensive security experiencerequired
2+ years of experience in a detection engineering, incident response, or offensive security role
from the posting - Public cloud platforms (AWS, Azure, GCP)required
Experience with 1 or more public cloud platforms (AWS, Azure, GCP)
from the posting - Attacker TTPs in zero trust environmentsrequired
Deep understanding of attacker TTPs across modern zero trust environments, including identity compromise, token theft, and abuse of trust boundaries
from the posting - macOS internals and telemetryrequired
Proficient understanding of macOS internals and telemetry available to identify macOS specific threats
from the posting - Detection-as-code workflowsrequired
Experience implementing detection-as-code workflows including version control, peer review processes, automated testing, and CI/CD deployment pipelines
from the posting - Python, Golang or other programming languagesrequired
Basic proficiency with Python, Golang, or other programming/scripting languages
from the posting - Relevant security certifications (GCFA, GCFE, GNFA, GREM, OSCP, GCIA)required
Relevant certifications: GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar
from the posting - Offensive security or red teaming backgroundpreferred
Background in offensive security or red teaming
from the posting - Machine learning for threat detectionpreferred
Knowledge of machine learning for threat detection
from the posting
Read the full posting as the employer wrote it
We're transforming the grocery industry
At Instacart, we invite the world to share love through food because we believe everyone should have access to the food they love and more time to enjoy it together. Where others see a simple need for grocery delivery, we see exciting complexity and endless opportunity to serve the varied needs of our community. We work to deliver an essential service that customers rely on to get their groceries and household goods, while also offering safe and flexible earnings opportunities to Instacart Personal Shoppers.
Instacart has become a lifeline for millions of people, and we’re building the team to help push our shopping cart forward. If you’re ready to do the best work of your life, come join our table.
Instacart is a Flex First team
There’s no one-size fits all approach to how we do our best work. Our employees have the flexibility to choose where they do their best work—whether it’s from home, an office, or your favorite coffee shop—while staying connected and building community through regular in-person events. Learn more about our flexible approach to where we work.
Overview
Instacart's Detection Engineering team sits at the core of our Security organization, building and operating the systems that identify, surface, and respond to threats across one of North America's largest grocery technology platforms. We own the full detection lifecycle, from telemetry collection and signal design to automated response, across a complex, cloud-native environment spanning endpoint, cloud, container, and SaaS.
As a Detection Engineer, you'll be a technical anchor on the team: developing high-fidelity detection logic, hunting for novel attacker techniques, and raising the bar for how we think about coverage, quality, and scale. You'll work closely with Engineering, Red Team, Incident Response, Fraud, and Trust & Safety to ensure our detections reflect real-world adversary behavior (and not just signatures).
We operate with a detection-as-code mindset: everything we build is versioned, tested, and deployed through repeatable pipelines. We care deeply about reducing noise, improving analyst efficiency through automation and SOAR, and continuously evolving our coverage as the threat landscape shifts.
If you're energized by hard forensic problems, enjoy translating attacker TTPs into durable detection logic, and want to help shape the future of a growing security function, this role is for you.
About the Job
- Develop, tune, document, and maintain detection logic across multiple log sources including endpoint, cloud, container, and SaaS products.
- Assist in cyber forensic investigations across a variety of log sources
- Optimize log ingestion pipelines and telemetry collection to ensure high-quality, actionable security data while managing volume and cost
- Design and build SOAR playbooks and automation workflows to streamline detection triage, enrichment, and response actions
- Mentor/knowledge share with other detection engineers on threat hunting methodologies, detection logic development, and investigation techniques
About You
Minimum Qualifications
- 2+ years of experience in a detection engineering, incident response, or offensive security role.
- Experience with 1 or more public cloud platforms (AWS, Azure, GCP)
- Deep understanding of attacker TTPs across modern zero trust environments, including identity compromise, token theft, and abuse of trust boundaries
- Proficient understanding of macOS internals and telemetry available to identify macOS specific threats
- Experience implementing detection-as-code workflows including version control, peer review processes, automated testing, and CI/CD deployment pipelines
- Basic proficiency with Python, Golang, or other programming/scripting languages
- Relevant certifications: GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar
Preferred Qualifications
- Background in offensive security or red teaming
- Knowledge of machine learning for threat detection
#LI-remote
Instacart provides highly market-competitive compensation and benefits in each location where our employees work. This role is remote and the base pay range for a successful candidate is dependent on their permanent work location. Please review our Flex First remote work policy here. Currently, we are only hiring in the following provinces: Ontario, Alberta, British Columbia, and Nova Scotia.
Offers may vary based on many factors, such as candidate experience and skills required for the role. Additionally, this role is eligible for a new hire equity grant as well as annual refresh grants. Please read more about our benefits offerings here.
For Canadian based candidates, the base pay ranges for a successful candidate are listed below.
The posting text is reproduced as the employer wrote it; the index adds nothing to it.