Senior Detection and Response Engineer - UK

Job description

Senior Detection and Response Engineer (Cheltenham, UK) Location: Cheltenham, UK Team: Product & Engineering Employment Type: Full-Time, Remote About VulnCheck Exploitation prevention is only as strong as the intelligence driving those efforts, and most of the industry is still running on intelligence that lacks exploit context. VulnCheck, The exploit intelligence company, delivers structured exploit intelligence on what is actively weaponized in the wild, purpose-built for the data lakes, ETL pipelines, automation, and AI and LLM workflows your infrastructure already runs on, raising the capability of everything it powers. About the Role Our Target and Canary Intelligence products provide unique visibility into vulnerable assets on the internet, attacker infrastructure, and attacks that leverage vulnerabilities for initial access. Target Intelligence maintains a continuously updated view of internet-facing systems — the services and versions they run, and their exposure to vulnerabilities. Canary Intelligence deploys intentionally vulnerable systems across the internet and captures real exploitation attempts as they happen. We are looking for an experienced detection and response engineer to help scale the durable detections behind these products. These detections generate world-class, vulnerability-centric threat intelligence our customers rely on to defend themselves against exploitation activity on the internet. You'll have wide latitude to shape how VulnCheck stays ahead of an accelerating volume of vulnerabilities - the tooling, the workflows, and the standards for detection engineering at scale. Although this is a 100% remote role, candidates must be located in or around Cheltenham, United Kingdom. What You'll Do Design and direct AI-assisted, agentic detection workflows that scale coverage to an accelerating volume of vulnerabilities, with you on the loop for quality Author and ship network signatures and detections against internet-scale scan and probe data to identify services, versions, and whether hosts are vulnerable. Build detections against Canary telemetry that separate real exploitation signal from internet noise, and synthesize that signal into threat intelligence customers can act on Drive feedback loops into our probing and collection capabilities - identifying what data we should collect, what we shouldn't, and where coverage gaps exist…