Security Engineer II, Threat Detection

The Detection Engineering and Threat Hunting team builds high-signal detection content. We partner closely with internal stakeholders and leverage Datadog’s own security products to continuously evolve our detection and response capabilities.

As a Threat Detection Engineer II, you will deliver detection content sourcing a wide variety of data, especially cloud native datasets and workload runtime events, to detect threats in near real-time. You will creatively identify ways to provide detection coverage across different technology classes such as public cloud platforms, SaaS applications, endpoint and network technologies, and many more. Together with your team, you will research attacker techniques against cloud-native technologies and other attack surfaces. You’ll apply data-driven insights to generate the highest quality security signal for our incident response teams.

At Datadog, we place value in our office culture - the relationships and collaboration it builds and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them.

What You’ll Do:

• Learn everything about detecting threats in cloud-native environments and pour it back into building great cloud security content


• Research and ideate the most ideal way to operationalize telemetry end-to-end from our data platforms into our Cloud SIEM and Workload Protection products as detections


• Participate in responding to emerging threats and vulnerabilities with our Cyber Threat Intelligence and Incident Response teams, helping perform threat hunts and investigations


• Identify and drive inefficiencies out of content development processes through the creation of innovative tooling, automation; shepherd platform issues impacting content development and user experience through engineering to completion

Who You Are:

• A previous background in detection engineering, cloud security engineering or other operational security function


• Experience operating in at least one public cloud platform (AWS, GCP, Azure) and other cloud native technologies (Kubernetes, Docker, Terraform)


• Understanding of modern cloud native attacker techniques and are familiar with technical controls to prevent and detect these attacks


• Proficient understanding of Linux internals and associated telemetry to detect threats at runtime


• Experience detecting threats at scale through a wide variety of technologies and datasets using a modern detection engineering approach


• Proficiency with Python, Golang or other programming languages


• Experience measuring the quantitative and qualitative effectiveness of security controls to make data-driven decisions

Datadog values people from all walks of life. We understand not everyone will meet all the above qualifications on day one. That's okay. If you’re passionate about technology and want to grow your skills, we encourage you to apply.

Benefits and Growth:

• New hire stock equity (RSUs) and employee stock purchase plan (ESPP)


• Continuous professional development, product training, and career pathing


• Intradepartmental mentor and buddy program for in-house networking


• An inclusive company culture, ability to join our Community Guilds (Datadog employee resource groups)


• Access to Inclusion Talks, our internal panel discussions


• Free, global mental health benefits for employees and dependents age 6+


• Competitive global benefits

Benefits and Growth listed above may vary based on the country of your employment and the nature of your employment with Datadog.