Detection Engineer/Endpoint Security Engineer

About Mitsogo | Hexnode

Hexnode is a global leader in Unified Endpoint Management (UEM), trusted by over 100 countries and managing millions of devices worldwide. With a rapid pace of innovation, we have established ourselves as a dominant force across Apple, Windows, Android, macOS, Linux, and tvOS. Fuelling the transformation to a seamless ecosystem of connected tools, Hexnode is revolutionizing the enterprise software and cybersecurity landscape.

Job Overview:

We build Hexnode's XDR endpoint stack — a Windows kernel driver, Windows and macOS agents, and the server and console behind them. The driver and agents already emit a broad telemetry surface: process creation and termination, process access, image load, driver load, thread creation, registry key and value operations, network connections, DNS queries and file activity. We are actively extending the platform with advanced features. 

Telemetry on its own catches nothing. This role exists to turn that telemetry into detections that fire on real adversary behaviour, prove they fire, and keep them quiet enough that an analyst trusts them. You will own detection content end to end: write the rule, emulate the technique, verify the telemetry supports it, tune out the false positives, and document what we cover and what we don't. 

This is a hands-on engineering role, not an alert-queue role. You will spend your time in a lab with instrumented endpoints, in detection logic, and in the gap between what an attack does and what our sensors see. 

Key Responsibilities:

Detection content :

• Author, tune and maintain detection rules for endpoint threats, and keep coverage mapped to MITRE ATT&CK. 

• Translate techniques into concrete detection logic against the events our driver and agent emit 

• R