Detection Engineer

Artemis is building the future of AI-driven cybersecurity, helping companies defend themselves effectively in an era where AI is fighting AI on the cyber battlefield. Our platform brings a new approach to the $100B security operations market, building a live model of each customer's environment and using AI agents to detect, investigate, hunt, and respond to threats at machine speed. Just one year after our founding, Artemis is one of the fastest-growing cybersecurity companies of all time, with customers including multiple Fortune 500 companies, Global 2000 enterprises, and AI innovators like Cursor. We have raised $70M from Felicis, First Round Capital, Theory Ventures, Two Sigma Ventures, Lockstep VC and Brightmind. We are also backed by some of the most prominent operators in cybersecurity, including the CEO of Crowdstrike, the former CEO and CTO of Splunk, and the founders of Abnormal AI and Demisto. Artemis's founders have built and scaled security products used by tens of thousands of customers. Shachar Hirshberg (CEO) led Amazon GuardDuty, the world's largest cloud detection product, was an early employee at Demisto, the company that invented the SOAR category, was an engineering leader at Palo Alto Networks, and holds an MBA from Harvard. Dan Shiebler (CTO) led all AI and machine learning at Abnormal AI, the pioneer of behavior-based detection, spent five years building analytics using machine learning and vector databases at Twitter, and holds a PhD in machine learning from Oxford. Our team of software engineers, AI researchers, security engineers, and product designers comes from Google, Meta, AWS, Wiz, CrowdStrike, SentinelOne, Abnormal AI, Perplexity, Bridgewater, Mercor, CERN, and more. We're growing fast and looking for builders who want to help us serve our rapidly expanding customer base. About the Role We're looking for a Detection Engineer to own the detection content that powers the Artemis platform. You'll design, build, test, and continuously tune high-fidelity detections across cloud, identity, endpoint, and SaaS environments — treating detection as code, and using AI as a force multiplier at every step: authoring rules with AI assistance, and building anomaly detections that learn what's normal in each environment and flag what isn't. Detections at Artemis don't just fire alerts; they feed an AI-native investigation pipeline, so precision, rich context, and machine-readable output matter as much as coverage. This is a hands-on engineering role where every rule you ship directly determines what threats we catch for customers and how fast we catch them. Responsibilities Build and maintain the detection library - Design, implement, and own high-fidelity detections across cloud (AWS, Azure, GCP), identity (Okta, Entra ID), endpoint (EDR), and SaaS log sources, from hypothesis to production. Practice detection-as-code - Manage detection content like software: version-controlled rules, peer review, automated validation and testing, and CI/CD deployment across customer environments. Map and close coverage gaps - Measure detection coverage against MITRE ATT&CK, prioritize gaps based on real-world threat activity, and systematically close them. Validate against real attacks - Build and run attack simulations and test harnesses to prove detections fire on true positives and stay quiet on benign activity, before and after they ship. Tune relentlessly - Own false-positive and false-negative rates across the fleet: analyze detection performance data, tune noisy logic at the source, and sunset detections that no longer earn their keep. Use AI to write detections at scale - Leverage AI throughout the detection lifecycle: use AI-assisted workflows to author, convert, test, and document rules faster than any traditional team could, and build the tooling that makes AI-generated detection content trustworthy enough to ship. Build behavioral and anomaly-based detections - Go beyond static signatures: establi