Security Detection Engineer at Movable Ink

Movable Ink scales content personalization for marketers through data-activated content generation and AI decisioning. The world’s most innovative brands rely on Movable Ink to maximize revenue, simplify workflow and boost marketing agility. Headquartered in New York City with close to 600 employees, Movable Ink serves its global client base with operations throughout North America, Central America, Europe, Australia, and Japan.

Movable Ink is hiring a Security Detection Engineer to strengthen our security monitoring and detection capabilities. To succeed in this role, you'll combine deep technical curiosity with a methodical approach to threat detection, helping protect our platform and the hundreds of enterprise customers who depend on it. This is a hands-on opportunity to own and evolve our detection engineering practice, working closely with our Security Engineering team in NYC. You'll play a critical role in ensuring we can identify and respond to security threats quickly—whether they target our employees, infrastructure, or cloud environments.

Responsibilities:

Build, tune, and maintain detection rules and alerts in Splunk to identify security threats, suspicious activity, and policy violations
Reduce alert fatigue by continuously improving detection logic to minimize false positives while maintaining coverage
Monitor and develop detections for cloud security events across AWS and GCP using our CSPM tooling (Prisma Cloud)
Collaborate with the Security team to develop detection strategies based on threat intelligence and the MITRE ATT&CK framework
Investigate alerts and escalate confirmed incidents according to our incident response procedures
Set up and configure automation scripts and tooling for alert triage, ticket creation, and incident workflows
Create dashboards and reports to provide visibility into security posture and detection effectiveness
Document detection logic, runbooks, and response procedures
Support EDR (CrowdStrike) monitoring and investigate endpoint-related alerts
Identify opportunities to use Splunk for operational and product monitoring beyond pure security use cases

Qualifications:

2+ years of experience in a security operations, detection engineering, or SIEM-focused role
Hands-on experience writing and tuning SPL queries in Splunk
Familiarity with common attack techniques and the MITRE ATT&CK framework
Experience with cloud platforms (AWS or GCP) and understanding of cloud-specific threats
Exposure to EDR platforms (CrowdStrike preferred) and CSPM tools
Understanding of log sources such as Okta, Google Workspace, endpoint logs, and network traffic
Strong analytical and troubleshooting skills with attention to detail
Clear written and verbal communication skills; ability to document findings and escalate effectively
Self-motivated and comfortable working autonomously with a distributed team

Studies have shown that women, communities of color, and historically underrepresented people are less likely to apply to jobs unless they meet every single qualification. We are committed to building a diverse and inclusive culture where all Inkers can thrive. If you’re excited about the role but don’t meet all of the abovementioned qualifications, we encourage you to apply. Our differences bring a breadth of knowledge and perspectives that makes us collectively stronger.

We welcome and employ people regardless of race, color, gender identity or expression, religion, genetic information, parental or pregnancy status, national origin, sexual orientation, age, citizenship, marital status, ethnicity, family or marital status, physical and mental ability, political affiliation, disability, Veteran status, or other protected characteristics. We are proud to be an equal opportunity employer.

Security Detection Engineer

TLDR