Senior Security Engineer, Detection & Response

Role overview

Build and operate security detection and response capabilities across cloud, endpoint, identity, SaaS, application, and AI-agent environments. The role combines hands-on software engineering with incident response: you’ll improve the signals teams rely on, automate alert handling where it can be trusted, and help new services launch with the telemetry and response plans needed to investigate threats. This is a remote role aligned to Eastern or Central time zones, with participation in a 24/7 on-call rotation.

Responsibilities

- Develop and maintain detections across AWS services, endpoint protection, identity systems, SaaS tools, and an AI gateway; measure their coverage, precision, and speed. - Own a centralized security and audit log pipeline that supports investigation, analysis, and response by its users. - Detect account takeover, credential abuse, and other attacks against a two-sided marketplace. - Build alert triage and response workflows for enrichment, correlation, containment, and evidence capture, with verification for any AI-assisted decisions. - Write and ship security tooling in code, selecting, extending, or building tools to fit the need. - Add detection for AI-agent risks such as prompt injection, misuse of tool access, and data exfiltration; partner with product and platform teams on telemetry and response plans. - Participate in incident response and maintain detection controls required for compliance frameworks such as PCI DSS.

Requirements

- At least five years supporting product or engineering teams, cloud infrastructure, and corporate infrastructure in a security role. - Software engineering experience, preferably with Python, and the ability to build maintainable security systems using CI/CD practices. - Hands-on experience with AWS and infrastructure as code, plus working knowledge of EDR, SIEM, and SOAR platforms and their APIs. - Experience with containers and Kubernetes, including detection and forensic investigation. - Ability to own incidents from alert through diagnosis, remediation, and post-incident review. - Strong written communication for detection documentation, incident reviews, and engineering feedback. - Fluent use of AI-assisted coding or security tools, with a clear approach to directing and checking their output.

Nice to have

- Familiarity with observability and analytics tools such as Grafana, Looker, or New Relic; experience with LLM or agent security; and hands-on work with PCI, SOX, or similar compliance controls.

Benefits and work setup

- Remote work, with applicants expected to align with Eastern or Central time zones. - Salary range of $150,000–$225,000, with eligibility for a year-end bonus and equity. - Medical, dental, and vision coverage, flexible vacation, a retirement plan with employer match, and pet discount plans.