Detection & Response Engineer

Job summary

Responsibilities

Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv.

• Own detection and response end to end: what we log, what we alert on, how we triage and how we recover
• Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than…
• Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read
• Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under…
• Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls

What they're looking for

• Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward
• Experience building and tuning detections in a modern SIEM, ideally managed as code
• Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves…
• Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools
• Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity

Tech stack

• Kubernetes
• Python
• TypeScript
• Rust