(Senior OR Staff) Detection & Response Engineer

Job summary

Responsibilities

The IT and AI Enablement function helps Legora run securely and reliably as we grow. We are building an AI-native Information Security function. We ship security controls as software, and agents handle first-pass triage and routine investigation. People make the high-impact calls.

• Own detection and response across endpoints, identity, cloud workloads, SaaS, and Legora's AI systems. Hunt, triage, investigate, contain, and drive incidents through resolution…
• Build detections as production software on telemetry and pipelines provided by AI & Integrations Engineering. Keep them version-controlled, peer-reviewed, tested, and deployed…
• Build threat models, telemetry, and response playbooks for our AI systems, agents, and their tool use. Detect misuse of agents operating across the company.
• Build and supervise agents for triage, enrichment, and investigation. Set guardrails and approval thresholds for containment and other high-impact actions.
• Map coverage to MITRE ATT&CK and validate it through threat hunting, penetration-test findings, and adversary emulation.

What they're looking for

• 5+ years in detection engineering, incident response, or security operations, including work as a senior escalation point.
• Strong software engineering skills in Python and SQL. You build detections, automations, and telemetry pipelines that run reliably in production.
• You use LLMs and agents in day-to-day security work and know which decisions require a human. Be ready to show us an investigation or workflow you automated.
• Fluent across endpoint, identity, cloud, and SaaS telemetry. You reason from attacker behaviour and correlate signals across systems.
• You communicate clearly during incidents and turn incomplete technical evidence into sound decisions. Your post-incident reviews lead to concrete changes.

Tech stack

• Python
• SQL