Job Title: Detection Engineer – Security Analytics & AI Security

Experience:
3–6 years Role Overview We are looking for Detection Engineer Specialists to join the DART (Detection & Response) team within Security Research. The role focuses on developing, enhancing, validating, and maintaining security detection content for the Gurucul security analytics platform. The candidates will work on converting security requirements, attack techniques, log telemetry, and emerging technology risks into actionable detection use cases. The scope includes traditional enterprise security technologies as well as AI/LLM applications and agentic AI environments. The ideal candidates should have hands-on experience in security analytics, SIEM detection development, log analysis, and security use case creation. They should be able to understand how attacks manifest in telemetry and translate that knowledge into effective, testable detection logic.

Key Responsibilities
1. Detection Content Development
• Design, develop, test, and maintain detection models, queries, correlation logic, and security analytics content.
• Develop security use cases across Windows, Linux, endpoint, identity, cloud, network, firewall, proxy, and other enterprise log sources.
• Translate attack scenarios, security requirements, and threat intelligence findings into actionable detection logic.
• Develop detections for credential abuse, privilege escalation, lateral movement, persistence, suspicious process execution, and data exfiltration.
• Map detection content to MITRE ATT&CK; tactics and techniques to measure and improve detection coverage.
• Develop entity-based detection logic using relevant attributes such as user identity, hostname, source IP, and process information. 2. AI and Agentic Security Content Development
• Research and develop detection use cases for AI applications, LLM platforms, AI assistants, and AI agents.
• Analyze available telemetry from platforms such as ChatGPT, Anthropic Claude, Google Gemini, Microsoft Copilot, and other enterprise AI services.
• Develop detections for suspicious AI usage, unauthorized access, sensitive data exposure, suspicious agent actions, excessive permissions, and misuse of AI tools.
• Identify observable behaviors associated with AI-specific attacks, including prompt injection and unauthorized tool execution, where supporting telemetry is available.
• Map relevant detections to MITRE ATLAS and applicable OWASP AI security frameworks.




• Identify telemetry gaps and define requirements for new AI security data sources and detection opportunities. 3. Log Analysis and Detection Validation
• Analyze raw logs, event schemas, and field mappings to determine detection feasibility.
• Validate detection logic against representative datasets, attack scenarios, and known security events.
• Investigate false positives, false negatives, missing fields, and data quality issues.
• Tune detection logic to improve accuracy, reduce alert noise, and maintain SOC relevance.
• Document test cases, validation results, required log sources, field dependencies, and known limitations. 4. Security Content Maintenance and Enhancement
• Maintain and enhance existing out-of-the-box (OOTB) detection models and use cases.
• Review and update detection content based on new threats, customer requirements, and product changes.
• Maintain supporting metadata, including MITRE mappings, threat classifications, technology groups, and other applicable classifiers.
• Develop supporting dashboards, reports, queries, and investigation content as required.
• Identify content gaps and recommend improvements to increase security coverage and detection effectiveness. 5. Productization and Cross-Functional Collaboration
• Work with Product Management, Productization, QA, Customer Success, and other stakeholders to prepare detection content for release.
• Ensure content is documented, validated, and compatible with supported product versions and log source requirements.
• Investigate customer-reported detection issues and recommend corrective actions.
• Support content testing, release readiness, and post-release feedback analysis.
• Collaborate with Threat Research to translate validated research findings into detection use cases. Required Skills and Qualifications
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline, or equivalent practical experience.
• 3+ years of experience in detection engineering, SIEM content development, security analytics, threat hunting, or a related cybersecurity role.




• Hands-on experience developing security queries, detection rules, correlation logic, or analytical models.
• Strong understanding of Windows, Linux, endpoint, identity, network, and cloud security logs.
• Familiarity with SQL or comparable query languages used in SIEM and security analytics platforms.
• Knowledge of MITRE ATT&CK; and common adversary tactics, techniques, and procedures.
• Ability to analyze event data and translate security behaviors into testable detection requirements.
• Strong troubleshooting, analytical, documentation, and problem-solving skills. Preferred Qualifications
• Experience with SIEM, XDR, EDR, UEBA, or security analytics products.
• Familiarity with AI/LLM security, AI agents, SaaS audit logs, and cloud AI platforms.
• Knowledge of MITRE ATLAS and OWASP AI security frameworks.
• Experience with Python or scripting for detection validation and automation.
• Understanding of detection tuning, attack simulation, false-positive reduction, and security content lifecycle management.
• Experience developing security content for enterprise customers or commercial security products. Expected Deliverables
• Current and enhanced security detection models and use cases.
• Expanded detection coverage across enterprise technologies and AI ecosystems.
• Validated detection logic with documented test results and dependencies.
• Improved detection quality through tuning and false-positive reduction.
• Updated MITRE mappings and supporting security content.
• Release-ready content aligned with product requirements and customer needs. Success Criteria
• Quality, accuracy, and timely delivery of detection content.
• Improved coverage of prioritized MITRE ATT&CK; techniques and AI security scenarios.
• Effective validation and reduction of avoidable false positives.
• Completeness of documentation, mappings, and release requirements.
• Successful collaboration with Productization, QA, Product Management, and Threat Research. Ideal Candidate Profile A hands-on security content developer who understands attack behavior, can analyze telemetry, and can build reliable detections that security operations teams can use. The candidate should be comfortable working across conventional enterprise security technologies and emerging AI security use cases, with a strong focus on detection quality, validation, and product readiness.

📌 Detection Engineer – Security Analytics (Pune)
🏢 Gurucul
📍 Pune