Detection & Response Engineer

About Mars Security

Mars Security is an early-stage cybersecurity company building a new category of security technology, backed by deep hands-on experience from offensive security, threat intelligence, and security operations.

We're building a platform that lets security teams run continuous threat hunting and detection engineering across their existing stack. Most SOCs cannot tell you which active campaigns their environment would catch today. Mars closes that gap.

Founded by experienced operators, backed by world-class investors, and working with design partners across financial services, healthcare, pharma, and industrial security. We're building a team of people who thrive on ownership, ambiguity, and impact.

About the Role

Mars Security is looking for a Detection & Response Engineer who builds detections that fire on real attacks and knows what to do when they do. This role sits at the intersection of detection engineering, incident response, and threat hunting. You will design, test, and tune detection logic across real customer environments, investigate what it surfaces, and turn every finding into better coverage. You will work directly with founders and directly with customers. What you build shapes the product.

If you look at an alert queue and think about which attacks it would never catch, you should be talking to us.

What You'll Do

• Design, build, and validate detection rules across SIEM, EDR, cloud, identity and etc.
• Map detection coverage against attacker TTPs and active campaigns, and close the gaps that matter
• Tune detections to cut noise and false positives without losing signal
• Investigate and triage alerts and suspicious activity, and support incident response in customer environments
• Run hunts to find what existing detections miss, and turn findings into new detection content
• Build response playbooks and automation that shorten time from detection to containment
• Contribute to the platform by defining what good detection and response looks like at scale

What We're Looking For

• 5+ years hands-on experience in SOC, threat hunting, or detection engineering - MUST
• Detection engineering experience: you've written rules that caught real attacks, not just passed tests
• Incident response experience: investigation, scoping, containment, and root cause
• Strong query skills across detection languages (SPL, KQL, Sigma, YARA, etc.)
• Solid understanding of attacker TTPs, MITRE ATT&CK, and how campaigns operate end to end
• Familiarity with infrastructure: networking, identity, cloud, endpoint. You know where attackers hide because you know how the plumbing works
• Python proficiency for scripting, automation, and analysis
• Experience with detection-as-code, CI/CD for detections, or SOAR - a plus
• Malware analysis, threat intelligence, or red team background is a strong plus
• Excellent written and verbal English communication skills
• Strong customer-facing skills and ability to build trusted relationships with customers
• Team player with strong collaboration and communication skills

Why Mars Security

• Ground-floor opportunity at a well-funded, fast-growing cybersecurity company
• Direct access to founders and meaningful influence on the product roadmap
• Deep exposure to adversary research and real-world detection engineering at scale
• Work alongside a team built from offensive security and threat intelligence practitioners