Keeper Security

Senior Detection Engineer (SIEM / Security Observability)

Remote, US · Senior

Sponsorship not specifiedDetected 96 days ago

PythonAWSCloud PlatformsDatadogCybersecuritySIEMPipeline ManagementZero TrustCommunication

About the role

Description Keeper Security is seeking a Senior Detection Engineer to advance detection engineering, SIEM operations, and security telemetry across a globally distributed, cloud-native environment.
This is a 100% remote position, with an opportunity to work a hybrid schedule for candidates based in the El Dorado Hills, CA or Chicago, IL metro areas.

Design, build, and maintain detection and telemetry capabilities across Datadog, SentinelOne, and Wiz
Develop, test, and tune high-fidelity detection rules aligned to real-world attack scenarios and adversary behaviors
Implement and mature detection-as-code practices for scalable, version-controlled, and testable rule management
Build and optimize log ingestion, parsing, normalization, enrichment, and retention pipelines
Partner with Security Operations to improve triage workflows, incident response readiness, and escalation quality
Build dashboards, analytics, and reporting that support operational decision-making across Security, SRE, and Engineering
Perform detection gap assessments and evolve use cases based on threat intelligence, threat hunting, and emerging risks
Collaborate with cloud, infrastructure, product, and compliance teams to strengthen secure logging and observability patterns throughout the software development lifecycle
HR, hiring managers, interviewers*, IT support for system administration
Application responses and uploaded documents

5-8+ years of experience in detection engineering, SIEM engineering, security engineering, or security observability
Hands-on experience with SIEM, security analytics, or observability platforms, such as Datadog, SentinelOne, Splunk, Microsoft Sentinel, Elastic, or similar tools
Strong understanding of security telemetry across cloud, endpoint, identity, and application environments
Experience with log parsing, normalization, enrichment, and pipeline management
Proficiency in scripting or automation using Python, PowerShell, or similar
Ability to work cross-functionally with Security Operations, Engineering, Infrastructure, and SRE teams
explicit consent where required

Experience with Datadog Cloud SIEM, SentinelOne, Wiz, or similar modern security platforms
Experience with observability concepts including logs, metrics, traces, and instrumentation
Experience with SOAR, workflow automation, or response orchestration
Familiarity with Sigma or other detection-as-code frameworks
Experience in high-scale SaaS, cloud-native, or security product environments
Familiarity with zero-trust architectures, identity-centric security, and privileged access management
Strong knowledge of cloud environments, with AWS preferred

Keeper's cybersecurity software is trusted by millions of people and thousands of organizations globally.
Keeper is published in 23 languages and sold in over 150 countries.
About Keeper
Keeper is a pioneer of zero-knowledge and zero-trust security built for any IT environment.
Learn why Keeper is trusted by leading organizations to defend against modern adversaries at KeeperSecurity.com.
About the Job

Medical, Dental & Vision (inclusive of domestic partnerships)
Employer Paid Life Insurance & Employee/Spouse/Child Supplemental life
Voluntary Short/Long Term Disability Insurance
A generous PTO plan that celebrates your commitment and seniority (including paid Bereavement/Jury Duty, etc)

equal opportunity employer and participant in the U.S. Federal E-Verify program.

You opt into our talent database for further retention by providing consent (extended retention)

This listing is sourced directly from Keeper Security's careers page and normalized into a canonical job model.