Detection Engineer II

Instacart's Detection Engineering team builds and operates systems to identify, surface, and respond to threats across one of North America's largest grocery technology platforms. We own the full detection lifecycle, from telemetry collection to automated response, in a cloud-native environment spanning endpoint, cloud, container, and SaaS. As a Detection Engineer, you'll develop high-fidelity detection logic, hunt for novel attacker techniques, and work with Engineering, Red Team, Incident Response, Fraud, and Trust & Safety.

• Develop, tune, document, and maintain detection logic across endpoint, cloud, container, and SaaS log sources.
• Assist in cyber forensic investigations.
• Optimize log ingestion pipelines and telemetry collection.
• Design and build SOAR playbooks and automation workflows.
• Mentor other detection engineers on threat hunting and detection development.

• 2+ years in detection engineering, incident response, or offensive security.
• Experience with 1+ public cloud platforms (AWS, Azure, GCP).
• Deep understanding of attacker TTPs in zero trust environments.
• Proficient understanding of macOS internals and telemetry.
• Experience with detection-as-code workflows (version control, peer review, automated testing, CI/CD).
• Basic proficiency with Python, Golang, or other programming/scripting languages.
• Relevant certifications (GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar).

Preferred Qualifications: Background in offensive security or red teaming; knowledge of machine learning for threat detection.

Base pay ranges by location: CA, NY, CT, NJ: $171,000—$180,500; WA: $164,000—$173,000; OR, DE, ME, MA, MD, NH, RI, VT, DC, PA, VA, CO, TX, IL, HI: $157,000—$165,500; All other states: $142,000—$150,000. Eligible for new hire equity grant and annual refresh grants.