Detection & Response Engineer

Responsibilities

• Own detection and response across endpoints, identity, cloud workloads, SaaS, and Legora’s AI systems, including hunting, triage, investigation, containment, and incident resolution.
• Build, test, review, version-control, deploy, and tune production detection software using telemetry and data pipelines.
• Develop threat models, telemetry, and response playbooks for AI systems, agents, and agent tool use.
• Build and supervise agents for triage, enrichment, and investigation, including guardrails and approval thresholds for high-impact actions.
• Map detection coverage to MITRE ATT&CK and validate it through threat hunting, penetration-test findings, and adversary emulation.
• Participate in the on-call rotation, serve as incident commander for security incidents, and lead post-incident reviews.
• Investigate insider risk and identity abuse with Corporate Security, People, and Legal, and coordinate with Vulnerability Management and IT Systems.
• Track threat actors and campaigns targeting AI companies, convert intelligence into hunts and detections, and own the digital-risk platform and urgent phishing and impersonation takedowns.

Requirements

• At least 5 years of experience in detection engineering, incident response, or security operations, including experience as a senior escalation point.
• Staff-level candidates are expected to have roughly 10 or more years of experience and experience setting detection and response strategy.
• Strong software engineering skills in Python and SQL, with experience building reliable production detections, automations, and telemetry pipelines.
• Experience using LLMs and agents in security work and understanding which decisions require human judgment.
• Fluency across endpoint, identity, cloud, and SaaS telemetry, with the ability to correlate signals based on attacker behavior.
• Clear incident communication skills and the ability to turn incomplete technical evidence into sound decisions.
• Preferred experience with a modern SIEM or security data lake and at least two of SPL, KQL, YARA-L, Sigma, or SQL.
• Preferred experience securing AI systems, agent tool use, and AI data flows, including prompt injection and exfiltration risks.
• Preferred experience with response automation, incident management, digital forensics, malware analysis, threat intelligence, insider risk, or DLP.

Benefits

• Global collaboration with teams and clients across Europe, APAC, and North America.
• Comprehensive salary and benefits package with tools for success.
• In-person work in the Union Square office with company-provided lunch daily.
• Medical, dental, and vision plans, including options through Aetna, Kaiser Permanente, MetLife, and Vision Care.
• HSA or Healthcare FSA, dependent care FSA, parental leave, Maven Clinic access, and One Medical membership for employees and dependents.
• Pre-tax commuter benefits, life insurance, short-term and long-term disability coverage, and a 401(k) with company match.
• Unlimited PTO and voluntary benefits including identity protection, legal coverage, and pet savings programs.