Applied Cyber, Email Security (Detection Engineering)

US Remotefull time

Remote

$120k–$180k

H1B: no

Doppel Applied Cyber Email Security Detection Engineer at Doppel responsible for investigating email threats and detection failures and developing scalable detection capabilities. This role involves using AI and coding agents to automate investigative work and partnering with product and engineering teams.

Responsibilities

You’ll investigate the hardest email threats and detection failures, then turn what you learn into detections, evals, AI behavior, and product capabilities that scale across every Doppel customer. As our technology learns to handle today’s problems, you’ll move up the complexity curve to solve the next ones.
Own detection problems end-to-end — from emerging TTP or FN → investigation → detection hypothesis → validation → production coverage → measurement.
Use AI as a force multiplier — build evals, supervise model behavior, use coding agents aggressively, and automate repetitive investigative work.
Partner with Product and Engineering on signals, detection logic, edge cases, and validation.
Work with customers and GTM on detection gaps, real-world TTPs, and platform behavior.
Turn tooling, threat-intelligence partnerships, and provider relationships into new signals and detection capabilities.

Qualification

Thrive at the intersection of securitySEG/email-security depthExperience with M365/Exchange OnlineDetection-as-codeBuilt agentic security workflowsExperience with Agentic SOCShape the product

Required

Bring deep practitioner judgment from one or more of detection engineering, SOC/IR, threat intelligence/OSINT, or email/messaging security; range across multiple areas is a major plus.
Take messy detection failures from “something’s off” to root cause — prove what matters in the data and turn FP/FN cases into durable fixes.
Think like both attacker and defender across phishing, BEC, impersonation, credential theft, ATO, and evolving social-engineering TTPs.
Turn expert judgment into detection logic, evals, tests, requirements, and systems that scale beyond a single investigation or customer.
Thrive at the intersection of security, AI, product, and customers — challenge assumptions, use coding/AI agents aggressively, and move fast through ambiguity.

Preferred

SEG/email-security depth: SPF, DKIM, DMARC, headers, mail flow, and sender identity.
Experience with M365/Exchange Online, Google Workspace, or email-security APIs.
Detection-as-code, eval datasets/labeling, model benchmarks, or LLM/ML security systems.
Built agentic security workflows, autonomous triage, or LLM evaluation systems.
Experience with Agentic SOC, SIEM/TI tooling, and threat-intelligence provider/vendor partnerships.
Shape the product, not just operate it. You work on real emerging attacks and turn practitioner judgment into detections, AI behavior, and product capabilities alongside Product, Engineering, AI/ML, customers, and ecosystem partners.

Benefits

PTO
Equity/RSU
Parental Leave

Company

Doppel

View company page

Source: ashby

Active within the past hour

Remote-friendly

More roles at Doppel

IT Manager

US Remote

Product Manager

San Francisco · Remote

Software Engineer, Email

San Francisco, New York · Remote

Product Security

US Remote

Boost Your Interview Chances

Improve Resume Match Score

Free

Your Score

9.0

Strong Applicant

Must-Have Skills for This Role

detection engineeringSOC/IRthreat intelligenceOSINTemail securityAI

Optimize my Resume

Apply Faster with Autofill

Free

Save your profile once. LumiJobs pre-fills the employer's application form so you stop re-typing the same answers on every site.

Apply With Autofill

Or skip LumiJobs's tools and submit directly on the employer's career site.

Apply on Employer Site