Staff Detection & Response Engineer

Responsibilities

• Own the Detection & Response roadmap, including telemetry strategy, detection engineering, alert quality, response processes, and coverage metrics.
• Define detection architecture and determine logging, telemetry destinations, in-house development, and partner-tool usage.
• Build and maintain detection coverage across AWS, endpoints, identity, SaaS, and CI/CD environments.
• Create versioned and tested detections as code and build audit logging and telemetry pipelines, including data-access and AI/agentic activity detections.
• Own incident response activities including triage, containment, forensics, postmortems, and remediation tracking.
• Improve incident response processes in incident.io through runbooks, severity definitions, escalation paths, and tabletop exercises.
• Lead technical investigations involving insider risk and unauthorized access.
• Build and operate the InfoSec on-call rotation, automate safe response actions, and provide technical leadership during incidents.

Requirements

• 6+ years of security experience with meaningful detection engineering and incident response experience in cloud-native environments.
• Hands-on experience writing SIEM rules or detection-as-code pipelines and managing false-positive rates.
• Experience leading real security incidents, including technical investigations and response.
• Strong command of cloud-native logging and detection surfaces, with AWS strongly preferred.
• Experience with EDR at fleet scale and identity-based detection.
• Fluency in at least one automation language such as Python, Go, or Ruby.
• Ability to work effectively in a regulated fintech environment.
• Preferred experience includes building a detection program from scratch, detecting AI/LLM or agentic abuse, investigating insider threats and unauthorized access, and working in consumer fintech or financial services.