Staff Engineer, Detection and Response

Role overview Lead the strategy and hands-on delivery of detection and incident response for a security team. You’ll build systems that help identify, investigate, and contain threats, lead the response to high-severity incidents, and establish practices that allow the wider team to operate effectively. The role also sets direction for using AI in triage and response with appropriate guardrails and human oversight.

Responsibilities - Turn detection and response priorities into multi-quarter plans, communicate progress and risks, and work with engineering, infrastructure, and IT teams to plan telemetry and response readiness. - Define shared standards for detections and response as code, reviews, playbooks, and AI-assisted workflows; mentor engineers and help develop team capability. - Own detection architecture and coverage planning, including telemetry onboarding, enrichment, correlation, alert routing, threat intelligence, signal quality, and cost. - Build and maintain detections, threat hunts, and automations; test them with unit tests, historical data replay, and attack simulations, and review gaps, latency, and false positives. - Improve incident response plans, severity and escalation practices, on-call readiness, forensic preparation, and cross-functional tabletop exercises. - Lead major incidents, measure response quality, and apply incident lessons to detections, automation, and process; evaluate AI-assisted workflows for speed and signal quality.

Requirements - Eight or more years in detection and response, detection engineering, security engineering, or incident response. - Demonstrated leadership of detection and response strategy or multi-quarter initiatives with measurable outcomes. - Hands-on experience designing detection architecture and delivering detections on a modern SIEM. - Strong Python, Git, CI/CD, and detection-as-code skills. - Experience leading high-severity incidents in cloud and SaaS environments and improving incident response practices. - Strong cloud and SaaS knowledge, ideally including GCP, and sound judgment under uncertainty with the ability to align technical and non-technical leaders.

Nice to have Staff, Lead, or Principal experience in a high-growth cloud or SaaS environment; production use of AI for triage or response; public security contributions or relevant certifications. Experience with Panther is valued, as is familiarity with common identity, collaboration, endpoint, infrastructure, and data platforms.

Benefits and work setup The listed US cash compensation range is $225,400–$281,800. Additional benefits may include equity, bonus, retirement savings, paid holidays, flexible time off, parental leave, wellbeing support, insurance, and healthcare accounts; details can vary by location and eligibility.