[Skip to main content](#main-content) [OpenNash Jobs](https://jobs.opennash.com/) [Hiring report](/reports/hiring/) · [All Copart jobs](https://jobs.opennash.com/companies/copart/) · [Search jobs](/search/) Copart · Dallas, TX - Headquarters # Detection Engineer Dallas, TX - Headquarters Full-time Operations Listed on Copart’s official careers site. Posted September 25, 2026. Check that it is still open and apply there. [Apply on Copart’s careers site →](https://copart.wd12.myworkdayjobs.com/Copart/job/Dallas-TX---Headquarters/Detection-Engineer_JR111663) [OpenNash Jobs](https://jobs.opennash.com/) / [Copart](https://jobs.opennash.com/companies/copart/) / Detection Engineer ## Job description Copart, Inc. a technology leader and the premier online vehicle auction platform globally, with over 200 facilities located across the world, Copart links vehicle sellers to more than 750,000 buyers in over 190 countries. We believe in providing an unmatched experience, every day and everywhere, driven by our people, processes, and technology. Copart is seeking a curious, engineering-minded Detection Engineer to join our global Security Operations team. You will build the detection content that identifies malicious activity across our endpoint, identity, network, and cloud estate — and prove that it works. ### Our detections are managed as code version-controlled, peer-reviewed, and deployed through automation. Much of our authoring and threat-intelligence triage is AI-assisted, with agentic workflows drafting detection logic before an engineer reviews and ships it. We want someone genuinely fluent in working alongside these tools — able to move quickly with them, and clear-eyed about when not to trust them. ### Key Responsibilities Detection Authoring & Tuning: Design and author detection logic targeting adversary behaviors across endpoint, identity, network, and cloud telemetry, favoring durable behavioral indicators over brittle atomic ones. Map content to MITRE ATT&CK and maintain complete rule metadata — owner, data sources, severity, lifecycle status. Tune detections using real investigation outcomes, distinguishing logic that is wrong from logic that is right in a noisy environment and applying the correct fix for each. ### Detection-as-Code & Automation Author detection content as code — rules, macros, lookups — in version control, using standard Git branching and pull request review. Help extend the CI/CD pipeline that validates and deploys content, including schema checks, linting, and automated quality gates. Write scripts and tooling (Python or similar) to automate repetitive work such as coverage reporting and data normalization, and partner with log source engineering to onboard new telemetry. ### AI-Assisted Detection Engineering Work fluently within AI-assisted and agentic workflows where language models draft detection logic and perform first-pass triage and enrichment. Critically review AI-generated content before it ships, taking full engineering ownership of the output regardless of how it was drafted. Help build and refine the agent skills, prompts, and tool integrations the team relies on, and exercise judgment about where a human must stay in the loop. ### Validation, Detection Health & Measurement Validate detection logic against historical telemetry and known-good and known-bad events before deployment, rather than relying on review alone. Monitor deployed detections for silent failure — rules that have stopped firing, queries that error, logic broken by schema or environment drift — and treat a detection that never fires as a defect to investigate, not as evidence of a clean environment. Contribute to attack simulation exercises and to program metrics covering coverage, alert fidelity, and detection health, converting every validated miss into detection work. ### Collaboration & Communication Partner closely with Incident Response to shape alert context and response guidance, and to close the loop between what fires and what gets built next. Create and maintain clear documentation — detection descriptions, triage guidance, runbooks, and lessons learned. Communicate detection logic, coverage gaps, and technical risk clearly to technical and non-technical audiences alike, including colleagues who are not native English speakers, and escalate concerns early with recommendations attached. ### Requirements & Preferences Required: Demonstrable cybersecurity experience in detection engineering, security operations, threat hunting, incident response, or security automation. Hands-on experience writing and tuning detection or search logic in a SIEM, EDR, or log analytics platform, and the ability to reason from an adversary technique to the telemetry that would reveal it. Practical familiarity with AI-assisted engineering workflows, including LLM tooling used for authoring or analysis, and the judgment to verify and correct what those tools produce. This is a core expectation of the role, not a bonus. Comfort with version control and pull request based collaboration, plus scripting ability in Python or a comparable language. Exceptional written and verbal communication, with clarity and audience-appropriate messaging — this is a non-negotiable attribute. Strong analytical skills, attention to detail, and the intellectual honesty to say "I do not know yet, and here is how I will find out." ### Preferred Approximately 2+ years in a dedicated cybersecurity engineering, detection, or security operations role, ideally with prior IT, infrastructure, or software engineering background. Experience with detection-as-code — content in source control, peer-reviewed, deployed via CI/CD. Experience with enterprise EDR and next-generation SIEM platforms, cloud security posture management, and vulnerability management tooling. Experience building or extending AI agent tooling, custom skills, or tool-server integrations that connect language models to operational systems. Familiarity with breach and attack simulation or adversary emulation tooling, commercial or open source, and comfort with APIs and structured data formats such as YAML and JSON. ### Candidate Profile The ideal candidate is a self-motivated engineer, genuinely curious about how adversaries operate and equally curious about how to prove a defense works. You are comfortable moving fast with AI-assisted tooling and equally comfortable being the person who catches when it is confidently wrong. You instinctively ask, "how would I know if this stopped working," and you would rather build the automation once than do the task fifty times. You will join a small team with strong engineering foundations and some real, openly acknowledged gaps — and meaningful ownership in closing them. ### Benefits Summary: - Medical/Dental/Vision - 401k plus a company match - ESPP - Employee Stock Purchase Plan - EAP - Employee Assistance Program (no cost to you) - Vacation & Sick pay - Paid Company Holidays - Life and AD&D Insurance - Discounts Along with many other employee benefits. #LI-KK1 At Copart, we are focused on harnessing the power of diversity, inclusion, and collaboration. By embracing diverse perspectives, we open doors to innovation and unleash the full potential of our team. We are dedicated to fostering a workplace where everyone feels appreciated, included, and inspired to grow and contribute meaningfully. ### E-Verify Program Participant Copart participates in the Department of Homeland Security U.S. Citizenship and Immigration Services' E-Verify program (For U.S. applicants and employees only). Please click below to learn more about the E-Verify program: E-verify Participation Right to Work ## At a glance - Posted by the employer: Sep 25, 2026 - First seen by OpenNash: Oct 11, 2026 - Last checked: Oct 18, 2026 - Listed for: 23 days - Location: Dallas, TX - Headquarters - Employment type: Full-time[Apply on Copart’s careers site →](https://copart.wd12.myworkdayjobs.com/Copart/job/Dallas-TX---Headquarters/Detection-Engineer_JR111663) ## More jobs at Copart ### [Business Licensing Specialist](https://jobs.opennash.com/companies/copart/jobs/ffabf7dbe051974f2157/) Dallas, TX - Headquarters ### [Elite Force Loader Operator](https://jobs.opennash.com/companies/copart/jobs/09f3a050157f14948022/) Dallas, TX - Headquarters ### [Field Engineering Intern](https://jobs.opennash.com/companies/copart/jobs/e4f881152f48a571dd4a/) Dallas, TX - Headquarters ### [QA Engineering Intern](https://jobs.opennash.com/companies/copart/jobs/037894c81607e26079f6/) Dallas, TX - Headquarters ## Similar jobs at other companies ### [Senior Network detection and Response Engineer](https://jobs.opennash.com/companies/unitedhealth-group/jobs/405f40b522c1f7a65927/) UnitedHealth Group · Plymouth, Minnesota ### [Senior Detection Portfolio Engineer](https://jobs.opennash.com/companies/microsoft/jobs/529782e55a29a4e28a94/) Microsoft · United States, Multiple Locations ### [Fire Detection Inspector](https://jobs.opennash.com/companies/johnson-controls-international/jobs/136d5538b9b8785de6f1/) Johnson Controls International · Springfield-Missouri-United States of America ### [Product Delivery Manager - Threat Detection & Analytics](https://jobs.opennash.com/companies/jpmorganchase/jobs/9afb557ad9a5dc3f3e01/) JPMorganChase · Jersey City, NJ, United States ### [Fire Detection Inspector](https://jobs.opennash.com/companies/johnson-controls-international/jobs/1beb2c3578465f84fe53/) Johnson Controls International · Hauppauge-New York-United States of America OpenNash lists jobs from employers’ own careers sites and does not handle applications. Dates come from the employer where stated; “first seen” and “last checked” are our own observations. OpenNash Jobs · Official listings with dates and links to the employer. [Weekly hiring report](/reports/hiring/) · [Methodology](/methodology/)