Senior Detection and Response Engineer

Own detection engineering and lead incident response across corporate and production environments, building cloud, endpoint, runtime, and Kubernetes coverage. The role requires 6+ years in security, hands-on detection development, and end-to-end incident leadership.

About the job

Responsibilities

Build and own detection coverage across cloud, endpoint, and runtime telemetry.
Own a centralized correlation and alerting capability that turns telemetry into actionable detections.
Lead incident response across corporate and production environments, including runbooks, escalation paths, and live incident coordination.
Detect anomalous activity across cloud, endpoint, and Kubernetes environments.
Tune detections to maximize signal and minimize noise.
Measure detection and response performance, including mean time to detect and respond.
Run incident retrospectives and apply lessons to detections and controls.
Partner with infrastructure security and IT to close gaps identified during response.

Requirements

6+ years of experience in security, with a strong focus on detection engineering and incident response.
Hands-on experience building detections and correlation across AWS, Azure, endpoint detection and response, and preferably container and runtime telemetry.
Experience owning incident response end to end, including leading live incidents.
Ability to build and scale a detection and response capability.
Sound judgment under pressure and clear incident communication.
Ability to work effectively with engineering and IT teams.

Nice-to-haves

Experience with SIEM or detection platforms and detection-as-code approaches.
Familiarity with runtime security tools such as Upwind or similar platforms.
Threat hunting or purple-team experience.
Background in AI or ML platforms or distributed systems.

Skills

AWS, Azure, Endpoint Detection And Response, Kubernetes, Container Security, Runtime Security, SIEM, Detection-As-Code, Threat Hunting, Purple Teaming