Our detection engine is a large Python codebase running PySpark over cloud, SaaS, and identity data at scale on Databricks. Youll own its engineering quality - hardening whats there and extending it - working alongside the cyber investigators who define what it should catch.
In this role, you will:
Harden and extend a large production Python codebase: refactoring, module and API design, typing, test coverage.
Own and optimize critical PySpark workflows processing massive security datasets across multi-cloud environments - correctness and cost both.
Design the data models and queries the engine depends on, and fix the slow ones.
Work directly with cyber investigators to turn attacker behavior into detection logic that holds up in production.
Build with AI as a core tool: AI coding agents daily, and the AI tooling the team runs on - agentic and automated workflows (n8n or similar) and LLM-backed services on Bedrock or vendor APIs.
Raise the bar on engineering practice - code review, CI, and the standards the team holds each other to.
Contribute to architectural decisions and technical direction as the platform evolves.An empty job that is used for creating requisitions 'from scratch'
Requirements: Who you are
5+ years of production Python at a company - typing, refactoring code you didnt write, module and API design, pytest, packaging, and a real code-review culture.
Hands-on SQL - you design schemas and you fix slow queries, not just read them.
AI-native - AI coding agents (Claude Code) are part of how you work, and youve shipped something real on top of an LLM: prompt design, structured outputs, orchestrating multi-step or agentic flows, and testing behavior that isnt deterministic. Which platform you used matters far less than having done it.
Fluent in Git and CI - you read a failed pipeline and fix it yourself.
Energized by fast-paced startup environments where ownership, adaptability, and collaboration are essential to success.
It Would Be Nice If You Also Had:
AWS (S3, IAM, compute) and AWS Bedrock workflow automation and agent platforms (n8n, LangGraph, Temporal) MCP servers or tool-calling integrations both Spark and Kafka a security, detection-engineering, or SIEM background.
This position is open to all candidates.