We’re hiring
We’re a small, fully remote, globally dispersed, and profitable tech startup with an MDR service specializing in highly technical clients.
IntrusionOps does three things: MDR, Red Team, and Incident Response.
Founded by hackers, we bring that mindset to all aspects of our services. We prioritize work quality over bureaucracy. Our clients range from high-tech AI, research, security, and crypto firms to finance and healthcare companies.
We’re privately held, meaning we do not take direction from non-technical private equity or VC. We have the freedom to design our services in a way we see as best for our clients.
High Agency, Low Social Overhead: We don’t have an HR department, mandatory culture meetings, or endless feedback forms. We value clear, direct, and technical communication over corporate politeness. We care about your engineering output and your ability to solve problems, not your ability to navigate office politics.
We were founded in early 2024, right as AI reached a tipping point for log analysis. AI hasn’t been bolted on; it’s been part of our DNA from Day 1.
You aren’t staring at the same internal network for five years. You’ll be hunting across a massive, diverse data set spanning dozens of high-tech cloud environments. If you’re a threat hunter who gets bored with static environments, this is your playground.
If you’re bored writing detections for Windows EventIDs and want to work with forward-thinking tech clients, many in the AI space, come work with us. We’re growing and looking for a deeply technical, hands-on Senior MDR Engineer.
Perks: Flexible time off/schedules, full-time remote, health benefits, training budget, home office stipend, mobile phone coverage, and 401k match plan.
About You
You are a deeply technical, hands-on practitioner. Your experience equips you to not only execute on assigned tasks but to drive initiatives that improve our service and team. You can be based almost anywhere in the world, provided you have fluent spoken and written English and can generally be available between 11am and 7pm ET. You aren’t a “ticket closer” - you act as a technical peer to our clients (many of which are security experts), helping them architect detections and understand the ground truth of emerging threats.
Hard Requirements:
- 5+ years in Detection Engineering, Threat Hunting, or IR.
- Proficient in Python & REST APIs: You must be able to automate workflows and interact with EDR/SIEM APIs beyond basic scripting. Python and/or Golang preferred.
- Detection-as-Code: Deep experience with Git-based workflows, rule validation, and CI/CD pipelines (we use these to deploy, test, and inspect telemetry).
- Query Mastery: High proficiency in at least two: KQL, SQL (Snowflake/Panther), Sigma, or Python (for detection dev).
- OS & Cloud: Fluent in Windows/Linux/macOS internals and at least one major cloud provider (AWS/GCP/Azure).
- Adversary Emulation: Experience using tools like Atomic Red Team or custom scripts to validate that your detections actually work. You’ll work on this with our Red Team.
Role Responsibilities:
- Alert Investigation: We don’t believe in a Tier 1 SOC. Our Detection Engineers respond to alerts. Our AI triage strategy and emphasis on engineering keep our alert queue extremely manageable.
- Engineering: Design and implement high-fidelity detections and hunt queries across Panther and SentinelOne.
- Integrations: Develop SIEM and EDR integrations in Python or Golang.
- Threat Hunting: Hunt across EDR and SIEM data sets. Our user base consists of power users writing code, using macOS, and operating multi-cloud SaaS environments.
- Research: Methodically discover gaps via Use Cases. Review public repos (Sigma, Elastic, Splunk, etc.) to ensure our rules cover real-world attack scenarios.
- Strategy: Assist with our deception strategy and deployments.
- Embrace AI: We use AI for development, triage, and across the business (except the hiring process!). We maintain a clear AI policy so our usage meets clients' privacy expectations.
- Collaboration: Work with our Red Team to transform adversary techniques into detection choke points.
- Client Communication: Discuss detections, onboarding, and the impact of emerging threats (e.g., log4j or Shai-Hulud).
- Scale: Mentor others and help scale our detection strategies across a diverse, multi-tenant environment.
- Incident Response: Be available for the “big ones” when a major threat or crisis emerges, we go the extra mile.
Logistics:
- Generally available 11:00 - 19:00 Eastern Time.
- Comfortable in a customer-facing role, explaining complex technical threats to diverse audiences.
Contact
Please email hi [at] intrusionops.com with a URL or PDF version of your resume.