Detection & Response Engineer

About the Opportunity

The DETECTION & RESPONSE ENGINEER role is responsible for developing and managing the detection and response program that protects the organization's infrastructure, research environment, and products from attacks. This position ensures effective logging, alerting, incident triage, and recovery, working closely with security, platform, and research engineering teams to secure a complex AI research and deployment environment.

Responsibilities

• Own end-to-end detection and response processes, including logging, alerting, triage, and recovery.
• Develop and tune detections as code across cloud environments, Kubernetes, identity systems, endpoints, and SaaS.
• Lead incident response from alert to containment and forensics, producing post-incident reports.
• Build automation to reduce manual triage including enrichment, correlation, containment, and evidence collection.
• Monitor AI agent and developer tooling telemetry and implement controls.
• Collaborate with engineers to ensure new systems have logging and response playbooks at launch.
• Conduct threat hunts and tabletop exercises, addressing identified vulnerabilities.
• Translate incident and detection metrics into evidence for SOC 2, ISO 27001, and customer security reviews.
• Participate in security incident on-call rotations.

Requirements

• Experience in hands-on incident response, including alert triage, investigations, and reporting.
• Proficiency in building and tuning SIEM detections, preferably managed as code.
• Knowledge of attacker techniques in cloud and Kubernetes environments and associated log indicators.
• Ability to write automation scripts or tools in Python, Typescript, Rust, or similar languages.
• Familiarity with major cloud platforms and Kubernetes auditing, RBAC, and workload identity.
• Sound written communication skills for incident documentation and leadership updates.
• Strong judgment regarding alerts, automation, and escalation.