GreyNoise Intelligence - Detection Engineer

• Detection and Traffic Tagging Operations • Write and tune Intrusion Detection System rules grounded in observed network behavior. • Maintain and improve tag coverage and quality: adding new tags, fixing broken ones, and de-duplicating overlaps. • Maintain benign actor classifications and known-scanner lists so non-malicious traffic is accurately labeled. • Resolve accumulated detection issues that degrade data quality for users and customers. • Use internal CLI tooling to lint, test, and deploy detection rules and tags at scale. • Read and analyze packet captures (pcaps) and related network artifacts during routine validation and debugging. • Validate detections against real traffic and own the trade-offs between false positives and false negatives for individual rules. • Triage and Pipeline Hygiene • Triage a steady stream of inbound detection requests, CVEs, and internal coverage questions. The team processes dozens of new items weekly. • Ensure detections are wired correctly end-to-end: from raw data through rule logic to tag output. • Flag edge cases, collisions, and unexpected behavior in tags or rules for deeper follow-up. • Collaboration • Work closely with researchers to keep them focused on longer-horizon projects. • Communicate clearly about what you are working on, blockers, and trade-offs when priorities shift. • Help sales, support, and customer success get faster, clearer answers on detection coverage questions. • What Success Looks Like • The backlog of smaller yet important detection work stops growing and quietly gets handled. • Tag and detection coverage feels predictable and systematic rather than ad hoc. • Internal teams get faster, clearer answers on coverage questions. • The rest of the research team has noticeably more uninterrupted time for complex work and bigger bets. • You develop reliable instincts for which detection issues matter most and can prioritize without constant direction. • Who This Role Is Good For • We are flexible on the level. This could be filled by someone in early to mid-career or by a senior practitioner willing to own operational detection work as a primary focus, with a possible path toward deeper research responsibilities over time. • Early-Career or Mid-Level • Comfortable with networking fundamentals and common protocols. • Can read pcaps today, or is eager to get to "pcaps in your sleep" quickly. • Understands basic security concepts: CVEs, exploit vs. vulnerability, false positives vs. false negatives. • Thrives on clear queues of work and shipping lots of small, concrete things. • Wants broad exposure to real-world internet traffic and detection engineering. • Senior • Strong background in detection engineering, DFIR, SOC operations, or network security. • Sees operational detection work as the foundation for credible research, not a stepping stone past it. Expect to own this for 6 to 9+ months before the role naturally expands. • Can turn vague problems into scoped, repeatable workflows. • Understands that high-leverage impact often comes from unglamorous, highly reliable execution.