Detection & Response Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of the end-to-end detection and response process, encompassing logging, alerting, triage, and recovery.

• Develop and refine detections as code across various cloud environments, Kubernetes, identity systems, endpoints, and SaaS applications.

• Evaluate detections based on coverage and precision instead of alert volume.

• Lead the incident response process from the initial alert to containment and forensics.

• Compose post-incident reviews.

• Create automation for triage enrichment, correlation, containment actions, and evidence collection.

• Utilize LLM-based tools where they can withstand auditing.

• Monitor AI agents and developer tools while developing telemetry and controls.

• Collaborate with platform and research engineers to establish logging and response playbooks in new systems.

• Conduct threat hunts and tabletop exercises, addressing any findings.

• Transform incident and detection metrics into evidence for SOC 2, ISO 27001, and enterprise customer security assessments.

• Work alongside the GRC team.

• Engage in a security incident on-call rotation.

• Report to the head of security and collaborate with platform and research engineers.

⛳️ Requirements

• Practical experience in incident response, including triaging real-time alerts, leading investigations, and preparing post-incident reports.

• Proficiency in building and tuning detections within a modern SIEM, preferably managed as code.

• Solid understanding of attacker movements in cloud and Kubernetes environments, encompassing IAM abuse, container escape, credential theft, and supply chain compromises.

• Capability to program in Python, TypeScript, Rust, or other languages to automate response tasks and integrate security tools.

• Familiarity with at least one major cloud platform.

• Knowledge of Kubernetes, including audit logs, RBAC, and workload identity.

• Strong writing skills for incident timelines, detection documentation, and updates for leadership.

• Sound judgment regarding alerting, automation, and escalation decisions.

• Participation in an on-call rotation for security incidents is required.

• Experience in monitoring GPU or HPC-style infrastructure, research environments with large datasets, AI agents, LLM tooling, or MCP servers is a plus.

• Cloud forensics experience, covering disk and memory acquisition, reconstruction of cloud audit trails, and chain of custody, is advantageous.

• Having published open-source detection content is a plus.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health, dental, and vision insurance.

• Opportunities for professional development and growth.

• Flexible work hours and remote working options.

• Supportive and inclusive company culture.