Security Engineer, Detection & Response

Role overview

Strengthen detection and incident response for a high-volume software environment. You’ll operate and improve the security monitoring pipeline, lead investigations, and build automation that helps teams identify and handle threats consistently. The role also includes modernizing security operations with AI-assisted tooling and contributing to cloud, infrastructure, and application security work as needed.

Responsibilities - Run the SIEM workflow, including bringing new log sources online, maintaining detection rules, and improving alert investigation. - Lead adoption of AI-assisted security operations tools and develop a practical modernization plan for their use. - Investigate alerts and coordinate timely containment and remediation with engineering and IT partners. - Lead incident response from investigation through containment and review; improve runbooks and response processes. - Build production tools that detect threats, add context to alerts, and reduce repetitive investigation work. - Make security operations easier for partner teams through documented log onboarding, detection proposals, and accessible runbooks. - Connect proactive and offensive security findings to improvements in detection coverage, while contributing across cloud, infrastructure, and application security. - Participate in the security on-call rotation.

Requirements - At least five years in security engineering, security operations, detection engineering, or software engineering with a security focus. - Production SIEM experience, including log onboarding, detection development and maintenance, and alert triage. - Ability to write production-quality code for security automation and detection-as-code. - Experience leading or substantially contributing to incident response. - Strong technical writing, risk-based prioritization, and verbal communication skills. - Ability to navigate unfamiliar codebases and complex systems, and willingness to join an on-call rotation.

Nice to have - Experience with AI-assisted security operations platforms or building language-model-supported investigation tools. - Cloud security at scale, especially AWS incident response; Mac or Linux endpoint forensics; or detection workflows in CI/CD. - Experience with mobile advertising technology or high-volume SaaS systems.

Benefits and work setup - Full-time remote work is available in specified U.S. states, with quarterly in-person team gatherings expected. - Base pay is listed as $200,000–$250,000 in certain major metro areas and $184,000–$220,000 in other approved locations, plus bonus. Benefits may include medical coverage and wellness support.