3 days ago
Boston, MA, USAMid Level
H1B sponsor
Base Salary
$130k - $170k/yr
Responsibilities
- Design, build, and scale high-signal detections across cloud, identity, endpoint, network, and application layers.
- Develop and maintain detection logic aligned with attacker behavior and MITRE ATT&CK.
- Translate threat intelligence into actionable detections and validate them through adversary emulation and testing.
- Build behavioral detections for account takeover, credential abuse, API misuse, automation attacks, privilege escalation, and data exfiltration.
- Tune alerts, reduce false positives, and implement automated enrichment and triage.
- Define and track detection KPIs such as precision, recall, false-positive rate, and MTTD.
- Support and lead incident investigations, including containment, root-cause analysis, and post-incident detection improvements.
- Participate in the on-call rotation and reduce operational overhead through automation.
- Partner with Engineering, IT, Infrastructure, Product, and GRC to ensure strong monitoring and detection coverage.
- Map detections to threat models, identify visibility gaps, and improve coverage as the environment scales.
- Apply analytics and machine learning techniques to improve detection fidelity and investigation workflows.
- Research emerging attack techniques and incorporate findings into detection strategy.
Requirements
- 4+ years of hands-on Information Security experience focused on detection engineering, threat detection, or security operations.
- Experience writing and tuning detections across cloud, identity, endpoint, or application environments.
- Familiarity with YARA, SIGMA, Suricata, or similar rule-based detection methodologies.
- Strong understanding of identity compromise, cloud abuse, lateral movement, and data exfiltration techniques.
- Expertise analyzing and building detections from cloud and SaaS telemetry, including authentication events, API activity, and system logs.
- Strong scripting skills in Python, Go, or PowerShell for automation and tool development.
- Experience supporting incident response investigations and participating in on-call rotations.
- Ability to work in a fast-paced, high-growth environment with strong analytical and systems-thinking skills.
- Ability to collaborate effectively and explain detection strategy to technical and non-technical stakeholders.
- Experience building detective controls for consumer-facing platforms or detecting authentication and API abuse at scale is a plus.
- Familiarity with data analysis or machine learning techniques for security detection or alert triage is a plus.
- A bachelor's degree in Computer Science, Information Security, or a related technical field, and/or relevant security certifications, is a plus.
Benefits
- Full-time position with equity and benefits.
- WHOOP participates in E-Verify to determine employment eligibility.
- The role includes participation in an on-call rotation.
About WHOOP
WHOOP builds a wearable health and performance tracker paired with an analytics app that measures sleep, recovery, and strain for athletes and health‑conscious consumers. Its business model combines device sales with a recurring membership that unlocks coaching features and insights. Founded in 2012 and headquartered in Boston, the privately held company also serves enterprise wellness programs and sports organizations seeking continuous performance monitoring.