Detection Engineer/Endpoint Security Engineer

Overview

Own detection content end to end for Hexnode's XDR endpoint stack: write detection rules, emulate techniques, verify the telemetry supports them, reduce false positives, and document coverage.

What you'll do

• Author, tune and maintain detection rules for endpoint threats, and keep coverage mapped to MITRE ATT&CK.
• Translate techniques into concrete detection logic against the events the driver and agent emit.
• Retire and replace detections that no longer earn their keep.
• Build benign emulations that reproduce the telemetry signature of a technique without shipping working offensive capability or live C2 into an internal build.
• Compare what a detection needs against what the agent and driver emit today, and write up concrete, implementable telemetry requests for the driver and agent teams.
• Contribute to data-model decisions for endpoint events.
• Flag where a proposed detection is not implementable with current sensors, early enough to change the plan.
• Triage alert noise from internal and customer telemetry and assemble false-positive candidates with evidence.
• Draft exclusion and whitelist filter logic and detection tuning, for review before deployment.
• Help maintain the goodware corpus and prevalence gating that back release-gate regression runs.
• Benchmark how competitors implement a given capability and write up the tradeoffs.
• Maintain a living ATT&CK coverage matrix.

What you'll need

• 2–4 years in detection engineering, threat hunting, SOC L2/L3, or endpoint security product engineering.
• Windows internals as they surface in telemetry: processes, threads and handles; services; the registry; scheduled tasks; PE files and Authenticode signing; the Security event log and logon types; common LOLBins.
• Sysmon or equivalent EDR telemetry.
• Detection rule tuning.
• MITRE ATT&CK fluency: from technique to detection logic to test case.
• Scripting in PowerShell and Python, enough to build your own tooling.
• Rule authoring, static PE analysis, and similarity hashing (imphash, ssdeep, TLSH).
• Malware triage and unpacking.
• GitLab and Jira in a product engineering workflow.

Nice to have

• Exposure to Microsoft's AV ecosystem (MVI, ELAM, AMSI, ETW Threat Intelligence) or to independent lab testing (AV-Comparatives, AV-TEST).
• macOS endpoint telemetry via the Endpoint Security framework.

Details

• Location: Chennai.