Senior Detection and Response Engineer - VulnCheck

About VulnCheck

Exploitation prevention is only as strong as the intelligence driving those efforts, and most of the industry is still running on intelligence that lacks exploit context. VulnCheck, The exploit intelligence company, delivers structured exploit intelligence on what is actively weaponized in the wild, purpose-built for data lakes, ETL pipelines, automation, and AI and LLM workflows.

About the Role

Our Target and Canary Intelligence products provide unique visibility into vulnerable assets on the internet, attacker infrastructure, and attacks that leverage vulnerabilities for initial access. Target Intelligence maintains a continuously updated view of internet-facing systems, while Canary Intelligence deploys intentionally vulnerable systems across the internet to capture real exploitation attempts.

We are looking for an experienced Detection and Response Engineer to help scale the durable detections behind these products. These detections generate world-class, vulnerability-centric threat intelligence our customers rely on to defend themselves.

You'll have wide latitude to shape how VulnCheck stays ahead of an accelerating volume of vulnerabilities — the tooling, the workflows, and the standards for detection engineering at scale. Although this is a 100% remote role, candidates must be located in or around Cheltenham, United Kingdom.

What You'll Do

• Design and direct AI-assisted, agentic detection workflows that scale coverage to an accelerating volume of vulnerabilities, with humans in the loop for quality.
• Author and ship network signatures and detections against internet-scale scan and probe data to identify services, versions, and host exposure.
• Build detections against Canary telemetry that separate real exploitation signal from internet noise, and synthesize that signal into actionable threat intelligence.
• Drive feedback loops into probing and collection capabilities by identifying data collection targets and coverage gaps.
• Continuously evaluate detection quality, measuring and tuning false positive and false negative rates.
• Respond rapidly when high-impact vulnerabilities drop by analyzing, building coverage, and shipping detections.
• Work alongside vulnerability researchers and threat hunters to connect detection engineering with exploit intelligence.

What You'll Bring

• 5+ years of experience building and shipping durable detections over network and host data.
• Experience scaling detection development and continuous evaluation processes using AI and agentic workflows with humans in the loop.
• A track record of researching, engineering, and validating durable detections across network and host telemetry with a disciplined approach to false positive management.
• Expertise in device fingerprinting, protocol analysis, and understanding how services manifest on the wire.
• Knowledge of attacker command-and-control techniques, covert channels, and exploitation artifacts through network traffic analysis.
• Background in host-based analysis and DFIR, understanding high-value telemetry collection and threat intelligence synthesis.
• Strong programming or scripting ability to codify detection logic for performant integration into engineering systems.
• Familiarity with CVE, NVD, KEV, or exploit intelligence datasets.
• A response mindset to rapidly analyze and ship detection coverage when new vulnerabilities drop.

Preferred Qualifications

• Experience developing and tuning detections in Suricata, Snort, Zeek, or writing Nuclei templates and scanner signatures.
• Published detection research, signatures, or open-source detection content.
• Experience with streaming systems or real-time data processing.
• Background in high-growth or startup environments.