Detection Engineer (Product Track)

About the Company

Our client is an early-stage cybersecurity startup building foundational endpoint security technology for Windows, Linux, and macOS.Their work lives deep in the operating system: processes, memory, kernel boundaries, and attacker tradeoffs. We focus on real threats, real exploits, and defensive systems that must hold up against skilled adversaries — not academic exercises.

About the Role

We are seeking a uniquely positioned professional: a Detection Engineer looking to transition into Product Management, or an experienced Technical Product Manager with 3+ years of hands-on Detection/SIEM engineering experience.
In this hybrid, highly impactful role, you will bridge the gap between deep detection engineering and strategic product strategy. You will own core detection capabilities end-to-end—from analyzing attacker techniques and writing detection logic to defining product requirements, prioritizing backlogs, and shaping our long-term detection roadmap.

What You'll Do

• Product Strategy & Delivery: Own the end-to-end lifecycle for key detection, endpoint,and SIEM capabilities—translating complex security requirements and threat landscapes into clear product specifications.
• Detection Design & Implementation: Design, build, and maintain high-fidelity, endpoint-, log-, and SIEM-based detections (using Sigma rules and behavioral signals) to ensure maximum coverage and minimal false positives.
• Cross-Functional Collaboration: Serve as the direct translation layer between Security Research, Incident Response, Engineering, and Leadership to align technical detection capabilities with customer value.
• Roadmap & Backlog Ownership: Maintain, prioritize, and drive the product roadmap for detection mechanics based on security risk, market needs, performance metrics, and technical feasibility.
• Threat & Product Discovery: Analyze real-world incidents, attacker TTPs (using MITRE ATT&CK), and customer requirements to continuously discover detection gaps and define new features.

Requirements

• Dual-Track Experience:

• A Detection Engineer with 3–5+ years of experience in endpoint security, SIEM, or incident response who wants to transition into Product Management.
• OR a Technical Product Manager with at least 3 years of prior hands-on
  experience in Detection Engineering, SIEM, or Incident Response.
  Hands-on Detection Expertise: Proven experience writing, testing, and maintaining Sigma rules and building rules for EDR, SIEM, or custom endpoint platforms.
• Deep Threat Understanding: Strong understanding of attacker techniques, tactics, and procedures (TTPs), intrusion patterns, and threat modeling.
• Product Mindset: Ability to write clear product/technical documentation, prioritize feature backlogs based on ROI/impact, and balance technical depth with business goals.
• Communication & Execution: Excellent written and spoken English, with the capability to work autonomously in a fast-moving, high-ownership, remote startup environment.

Nice to Have

• 3+ years of formal Product Management experience in a SaaS or cybersecurity startup.
• Experience with AI/ML-based anomaly detection systems or browser/identity security features.
• Practical incident response or SOC experience in production enterprise environments.
• Deep familiarity with MITRE ATT&CK-driven framework implementation.

Why Join Us

• Dual Impact: Combine your deep technical detection roots with strategic product leadership to build features that directly protect against real adversaries.
• High-Signal Focus: Drive development on behavior-based, high-value detection mechanisms rather than superficial checkbox rules.
• Remote Work: Join a flexible, remote team based in Romania.
• High Autonomy: Enjoy low bureaucracy, quick execution loops, and high ownership of critical platform components.
• Career Growth: Fast-track your development into a core product leader within an early-stage, high-growth cybersecurity startup.