Detection and Response Engineer

Responsibilities

• Build security telemetry pipelines across cloud execution environments, CI/CD systems, identity systems, endpoints, and agentic workloads.
• Continuously improve detections for attacks, abuse, and anomalous behavior.
• Own the alert pipeline end-to-end while maintaining a high signal-to-noise ratio.
• Lead incident response, participate in on-call, and triage, scope, contain, and remediate incidents.
• Write incident postmortems that drive durable security improvements.
• Proactively hunt for threats and build tooling that turns evidence into new detections.
• Build agents that triage alerts, enrich findings, gather evidence, and scope incidents with human-in-the-loop controls and evaluations.
• Run vulnerability response, evaluate impact, and drive remediation across infrastructure.

Requirements

• Proficiency in modern backend technologies and the ability to write production code in Python, TypeScript, or Go.
• AWS experience with IAM, VPC, KMS, GuardDuty, and CloudTrail, plus working fluency in at least one of Azure or GCP.
• Experience with Kubernetes detection, including audit logs, runtime telemetry, and workload identity.
• Knowledge of endpoint security on MacOS and detection and response techniques.
• Hands-on incident experience, including on-call participation, incident leadership, and postmortem writing.
• Strong written and verbal communication skills.
• A clear point of view on AI/LLM security and hands-on experience defending relevant threats.
• Prior experience with LLM red-teaming, agent sandbox research, or other AI-relevant security threat defense is a bonus.

Benefits

• Medical, dental, and vision insurance.
• Daily lunch, snacks, and beverages.
• Flexible time off.
• Competitive salary and equity.
• WiFi and cellphone stipend.