Senior Security Engineer - Detection Engineering

Linked In is the world's largest professional network, built to create economic opportunity for every member of the global workforce. Our products help people make powerful connections, discover exciting opportunities, build necessary skills, and gain valuable insights every day. We're also committed to providing transformational opportunities for our own employees by investing in their growth. We aspire to create a culture that's built on trust, care, inclusion, and fun – where everyone can succeed.

Join us to transform the way the world works.

Linked In is the world's largest professional network, built to create economic opportunity for every member of the global workforce. Our products help people make powerful connections, discover exciting opportunities, build necessary skills, and gain valuable insights every day. We're also committed to providing transformational opportunities for our own employees by investing in their growth. We aspire to create a culture that's built on trust, care, inclusion, and fun – where everyone can succeed.

Join us to transform the way the world works.

At Linked In, our approach to flexible work is centered on trust and optimized for culture, connection, clarity, and the evolving needs of our business. This role may be remote or hybrid. At Linked In, hybrid roles are performed both from home and from a Linked In office on select days, as determined by the business needs of the team. Remote roles are performed from the designated home work location upon time of hire, and any changes to this home work location requires a review of remote status and approval.

This role can be remote anywhere in the United States or be hybrid in Linked In’s Mountain View office location.

Linked In’s Information Security organization protects our members, data, and platforms by building resilient security controls, detecting threats early, and partnering across engineering to reduce risk at scale.

The Detection Engineering team is responsible for building and scaling Linked In’s threat detection capabilities. We partner closely with Incident Response, Threat Intelligence, Red and Purple Teams, Product Security, Identity & Access Management, and Cloud Security to identify, contextualize, and detect adversary activity across the enterprise. Our team develops and maintains high-fidelity detections while advancing the underlying security telemetry ecosystem through log ingestion, schema design, data normalization, automation, threat hunting, incident response support, and audit enablement.

As a senior individual contributor, you will design, build, and operate high-signal detections across endpoint, identity, cloud, and SaaS environments. You will leverage detections-as-code practices, telemetry modeling, and data-driven efficacy measurements to continuously improve detection coverage and quality. Working from adversary TTPs and threat hypotheses, you will develop resilient, low-noise detections validated through purple-team exercises, adversary emulation, and real-world incident learnings.

This is a hands-on engineering role focused on technical leadership, execution, and cross-functional collaboration.

• Implement and tune detection content across SIEM/XDR/EDR and cloud telemetry; measure precision/recall, latency, lift, and signal-to-noise ratio.
• Build detections-as-code with version control, CI/CD, unit/integration tests, staged canary rollouts, and safe rollback.
• Author and maintain SIGMA rules; translate SIGMA to KQL/SQL as needed.
• Integrate multi-cloud telemetry:
  Azure (Activity/Diagnostics), AWS (Cloud Trail, Guard Duty), GCP (Cloud Audit Logs, SCC).
• Operationalize Microsoft Defender XDR and Sentinel signals; leverage…