Detection and Response Engineer - UK

Role overview

Develop durable detection capabilities that turn large volumes of internet and host telemetry into actionable intelligence about vulnerable systems and exploitation. You will help set the methods and workflows for detection at scale, using AI-assisted processes with human oversight, and work closely with vulnerability researchers and threat hunters. The position is remote, with candidates expected to be based in or near Cheltenham, UK.

Responsibilities - Design AI-assisted detection workflows and oversee their quality as vulnerability coverage scales. - Create network signatures to identify exposed services, versions, and potentially vulnerable hosts in large-scale scan data. - Analyze telemetry from instrumented systems to distinguish real exploitation from background internet noise. - Improve data collection by identifying gaps and refining what probing systems capture. - Measure detection performance and tune false positive and false negative rates. - Respond to significant vulnerability disclosures by researching and rapidly shipping detection coverage. - Coordinate detection work with vulnerability research and threat hunting teams.

Requirements - At least five years building and delivering durable detections using network and host data. - Experience scaling detection development and ongoing evaluation, including AI or agentic workflows with human oversight. - Strong background in researching and validating detection logic, with disciplined handling of false positives and negatives. - Expertise in device fingerprinting and protocol analysis, including interpreting service behavior from network traffic. - Knowledge of command-and-control methods, covert channels, exploitation artifacts, and host-based analysis or digital forensics and incident response. - Programming or scripting ability to implement efficient detection logic. - Familiarity with vulnerability and exploit datasets such as CVE, NVD, or KEV.

Nice to have - Detection work with Suricata, Snort, Zeek, or similar tools, and experience writing scanner signatures or templates. - Published detection research or open-source detection content. - Experience with streaming or real-time data processing, or in a fast-growing organization.

Benefits and work setup The role is full-time and remote, with a location requirement of Cheltenham or nearby. The work supports cybersecurity intelligence used to help protect critical infrastructure, including medical devices, power grids, and telecommunications.