Detection Engineering Tech Lead, Detection Engineering Group -Cyber Defense Operations Section (RMI Telecommunication Security Supervisory Dep)
Read straight from 楽天グループ's careers page, verified 21h ago.Seekless can tailor your résumé to it.
Seekless can write your résumé for this posting first.
Before you apply
LocationTokyo, Japan; Osaka, Japan
SeniorityLead
Experience10+ yrs
DepartmentDetection Engineering Section
Company size10,000+ people
PostedSep 23, 2026 · 1mo ago
Verified live21h ago
At a glanceSummarised by Seekless from the posting.
10+ years in Cyber Security, with at least 5+ years in Detection Engineering or Security Research
Deep expertise in building detection pipelines, tuning logic for high-fidelity alerts, and managing the security rule lifecycle
Practical experience building/tuning models for anomaly detection and log analysis
Expert-level coding skills (Python, Go, or Rust) and mastery of Linux/Windows/Mac internals
Strong hands-on experience securing Kubernetes clusters, container runtimes, and microservices architectures
Understanding of Telco networks/protocols (e.g., 5G core, signaling) and Network Security (packet analysis, perimeter/internal controls)
Experience in penetration testing, exploit development, or red teaming
Bachelor's or Master's degree in Computer Science, Cyber Security, or equivalent
Relevant certifications (e.g., OSCP, GREM, GCFA, CKS, BTL2, or AI-Security credentials)
Experience with Infrastructure as Code (Terraform, Ansible, Crossplane)
Deep experience with eBPF tools (e.g., Tetragon, Falco, Cilium, Spyderbat)
Active contributor to open-source detection projects (e.g., Sigma, YARA, or custom AI-detection models)
Experience in high-scale environments (Telco, Cloud-Native, or FinTech)
Domestic/overseas business travel and relocation may be required
Skills
Python
Go
Rust
Kubernetes
Linux
Windows
Mac
eBPF
Git
Sigma
YARA
LLM
SOAR
Terraform
Ansible
Crossplane
Tetragon
Falco
Cilium
Spyderbat
Job Description:
About the Organization
Cyber Defense Operations is the core department responsible for ensuring the safety and security of Rakuten Group’s internet services. The Detection Engineering Section is tasked with architecting and building next-generation detection pipelines to defend critical infrastructure against autonomous, AI-driven attacks and sophisticated APTs. We lead the transition to a Detection-as-Code (DaC) model, utilizing eBPF-based runtime security, behavioral analytics, and LLM-integrated pipelines to deliver high-fidelity, actionable alerts. We are “defenders with an attacker’s brain,” committed to proactive, intelligence-led defense.
Job Duties
•
Detection-as-Code (DaC) Transformation: Build and manage an end-to-end detection pipeline featuring peer reviews, version control (Git), and a reusable repository of detection rules.
•
AI/LLM-Driven Detection: Architect and develop AI/LLM-based models to identify autonomous AI attacks. Use AI to automate log onboarding, normalize data, and filter “garbage logs” to drastically reduce SOC noise.
•
Advanced Runtime Security: Lead the implementation of kernel-level monitoring using eBPF-based tools to provide deep visibility into containerized (K8s) and Linux-based workloads.
•
Offensive Security & Threat Hunting: Perform continuous attack simulations (Red Teaming) to validate detection coverage. Lead proactive threat hunting initiatives informed by CTI and the MITRE ATT&CK/FIGHT frameworks.
•
Deception & Defense-in-Depth: Deploy and manage deception technologies to create high-interaction traps. Ensure detection logic aligns with our defense-in-depth architecture.
•
Cross-Functional Orchestration: Collaborate with DFIR, CTI, and SOC teams to ensure CTI is actively integrated into detection logic via AI-driven automation.
•
AI Guardrails & Security: Oversee the security of our own AI/LLM models, implementing guardrails to prevent model poisoning, prompt injection, and adversarial manipulation.
•
SOAR Integration: Partner with the SOC team to ensure detection logic feeds seamlessly into SOAR playbooks for machine-speed response.
Minimum Qualifications
•
Experience: 10+ years in Cyber Security, with at least 5+ years in Detection Engineering or Security Research.
•
Detection Engineering: Deep expertise in building detection pipelines, tuning logic for high-fidelity alerts, and managing the security rule lifecycle.
•
AI/ML/LLM Proficiency: Practical experience building/tuning models for anomaly detection and log analysis.
•
Technical Depth: Expert-level coding skills (Python, Go, or Rust) and mastery of Linux/Windows/Mac internals.
•
Container & K8s Security: Strong hands-on experience securing Kubernetes clusters, container runtimes, and microservices architectures.
•
Domain Knowledge: Understanding of Telco networks/protocols (e.g., 5G core, signaling) and Network Security (packet analysis, perimeter/internal controls).
•
Offensive Mindset: Experience in penetration testing, exploit development, or red teaming.
•
Education: Bachelor’s or Master’s degree in Computer Science, Cyber Security, or equivalent.
•
Certifications: Relevant certifications (e.g., OSCP, GREM, GCFA, CKS, BTL2, or AI-Security credentials).
Preferred Qualifications
•
Experience with Infrastructure as Code (Terraform, Ansible, Crossplane).
•
Deep experience with eBPF tools (e.g., Tetragon, Falco, Cilium, Spyderbat).
•
Active contributor to open-source detection projects (e.g., Sigma, YARA, or custom AI-detection models).
•
Experience in high-scale environments (Telco, Cloud-Native, or FinTech).
Work Environment
•
Department: Detection Engineering Section, Cyber Defense Operations.
•
Collaboration: Work with diverse teams including security researchers, threat hunters, and AI/ML specialists.
•
Tech Stack: Python/Go/Rust, Kubernetes, Linux, eBPF, Git/Sigma/YARA, LLM-integrated pipelines, SOAR, Terraform/Ansible.
•
Location: Japan (Tokyo or Osaka). Domestic/overseas business travel and relocation may be required.
Languages:
English (Overall - 3 - Advanced)
More roles at 楽天グループ
Hardware Engineer, Cloud Hardware Engineering Group -Cloud Infrastructure Section (RMI Cloud Platform Dep)Senior Engineer - 5G Core (RMI Core Network Operations Dep)RF Satellite Communication Engineers, Satellite Communication Section (RMI NTN Business Strategy Dep)Senior HRBP - HRBP Section, Mobile/RTS Human Resources Department, Group Human Resources Supervisory DepartmentGovernment Grants & Public Finance (RMI Innovation Program Development Business Dep)