Senior Detection and Response Engineer (Cheltenham, UK)

The role

You will design and direct AI-assisted detection workflows and author network signatures to identify vulnerable services. You will build detections against Canary telemetry and respond to high-impact vulnerabilities.

What you will do

• Design and direct AI-assisted, agentic detection workflows
• Author and ship network signatures and detections against internet-scale scan and probe data
• Build detections against Canary telemetry to synthesize threat intelligence
• Drive feedback loops into probing and collection capabilities
• Continuously evaluate detection quality by measuring and tuning false positive and false negative rates
• Respond rapidly when high-impact vulnerabilities drop
• Work alongside vulnerability researchers and threat hunters

Required qualifications

• 5+ years of experience building and shipping durable detections over network and host data
• Experience scaling detection development and continuous evaluation processes using AI and agentic workflows with humans on the loop
• Track record of researching, engineering, and validating durable detections across network and host telemetry
• Expertise in device fingerprinting and protocol analysis
• Knowledge of attacker command-and-control techniques, covert channels, and exploitation artifacts
• Background in host-based analysis and DFIR
• Strong programming or scripting ability
• Familiarity with CVE, NVD, KEV, or exploit intelligence datasets
• A response mindset

Nice to have

• Experience developing and tuning detections in Suricata, Snort, Zeek, or similar
• Writing Nuclei templates or other scanner signatures
• Published detection research, signatures, or open-source detection content
• Experience with streaming systems or real-time data processing
• Background in high-growth or startup environments

Benefits

• Generous, flexible time off
• Retirement/pension plan contributions
• Comprehensive healthcare coverage
• Generous paid parental leave
• Remote-friendly environment with flexibility
• Support for home office costs (phone & internet)

About the company

VulnCheck is an exploit intelligence company that delivers structured exploit intelligence on what is actively weaponized in the wild. The company was founded in 2021 in Lexington, Massachusetts.