# Staff / Principal Software Engineer, Detection and Response

**Company:** [Lovable](https://hotfix.jobs/companies/lovable)
**Location:** Stockholm, Sweden
**Role:** Security Engineering
**Experience:** 8+ years
**Skills:** GCP, AWS, Cloudflare, Endpoint Edr, Panther, Elastic, Snowflake, ClickHouse, Mitre Att&Ck, Threat Intelligence, Purple Teaming, Terraform, Grafana, React, TypeScript
**Posted:** 2026-08-14

> Leads detection engineering and incident response across corporate, production, and AI-agent environments. The role requires 8+ years of relevant experience, strong detections-as-code expertise, cloud and telemetry knowledge, and proven leadership of high-severity security incidents.

## Job Description

## Requirements
- 8+ years in detection engineering, incident response, or threat hunting, including at least 3 years at staff/principal level.
- Strong engineering background with detections-as-code rather than saved SIEM searches.
- Deep experience with cloud telemetry (GCP, AWS, Cloudflare), endpoint EDR, identity logs, and modern SIEM/data-lake stacks including Panther, Elastic, Snowflake, and ClickHouse.
- Experience leading high-severity incidents from first alert through public post-mortem.
- Familiarity with MITRE ATT&CK, threat intelligence, purple teaming, and red-team collaboration.

## Responsibilities
- Build the detection engineering platform, including pipelines, detections-as-code, automated triage, and response playbooks.
- Design and own a security incident response process with 24/7 coverage using a small, high-leverage human and agent team.
- Lead incidents end-to-end: detection, containment, eradication, post-mortem, and follow-through.
- Proactively hunt across corporate, production, and AI-agent surfaces, turning findings into durable detections.
- Define and build world-class detection and response capabilities for an AI-native company.

## Nice to Have
- Experience detecting LLM or agent abuse, prompt injection at scale, or insider risk in AI-augmented engineering organizations.

## Technology Stack
- Frontend: React, TypeScript
- Backend: Golang, Rust
- Cloud: Cloudflare, GCP, AWS, and multiple LLM providers
- DevOps and tooling: GitHub Actions, Grafana, OpenTelemetry (OTEL), Terraform
- Data: ClickHouse, Firestore, Spanner, BigQuery

## Similar jobs

- [Staff / Principal Software Engineer, Infrastructure Security](https://hotfix.jobs/jobs/661af102-7e71-41fb-b9ca-d0d1512b47ce) - Lovable - Stockholm, Sweden
- [Senior Security GRC Analyst](https://hotfix.jobs/jobs/b54fb115-3bb7-4d88-8fdc-b7901d26d90d) - Monarch - Remote - $180k – $215k/yr
- [Lead Product GRC Subject Matter Expert](https://hotfix.jobs/jobs/57c937d5-05e3-4033-875a-890645c4aa6b) - Vanta - Remote - $230k – $270k/yr
- [Platform Security Engineer](https://hotfix.jobs/jobs/e556dd76-0f95-4dfa-9d3d-e476f24057c0) - Supabase - Remote
- [Security Engineer, Corporate](https://hotfix.jobs/jobs/dcd1e85d-0333-46e1-82bd-188613dd7173) - Lovable - Stockholm, Sweden

**Apply:** https://hotfix.jobs/jobs/f26e16c9-f4a3-4115-a29e-832eaa1e750a
**Canonical:** https://hotfix.jobs/jobs/f26e16c9-f4a3-4115-a29e-832eaa1e750a