5-7 years of experience in security engineering or related field
Proficient in Python, TypeScript, or Go for backend development
Experience with AWS services like IAM, VPC, KMS, GuardDuty, and CloudTrail
Familiarity with Kubernetes detection and telemetry
Hands-on experience in incident response and writing postmortems
Strong communication skills, both written and verbal
Knowledge of AI/LLM security and relevant defense techniques
Responsibilities
Build security telemetry pipelines across various cloud environments
Continuously enhance detection capabilities for threats and anomalies
Manage the alert pipeline to maintain high signal-to-noise ratio
Lead incident response efforts, including triage and remediation
Proactively hunt for threats and develop detection tools
Create agents for alert triage and evidence gathering
Oversee vulnerability response and remediation across infrastructure
Benefits
Medical, dental, and vision insurance
Daily lunch, snacks, and beverages
Flexible time off
Wifi and cellphone stipend
Full Job Description
About the role
We're looking for a Detection and Response engineer to design and build systems that identify, analyze, and eradicate threats across the Braintrust stack. You'll practice detection-as-code, run security operations with agents, lead incident response, and stay ahead of the curve incorporating real-time threat intelligence. Have a big impact with a small team that has outsized capabilities.
What you'll do
Build security telemetry pipelines across cloud execution environments (ECS/K8s), CI/CD systems, identity systems, endpoints, and agentic workloads
Continuously improve detections for attacks, abuse, and anomalous behavior
Own the alert pipeline end-to-end and keep signal-to-noise high
Lead incident response and participate in on-call: triage, scope, contain, and remediate incidents, then write postmortems that produce durable improvements
Hunt proactively for threats and build the tooling for turning evidence into new detections
Build agents that triage alerts, enrich findings, gather evidence, and scope incidents, with human-in-the-loop controls and evals that keep the automation trustworthy
Run vulnerability response, evaluating impact and driving remediation across our infrastructure
Ideal candidate credentials
Proficient in modern backend technologies and comfortable writing real code in Python, TypeScript, or Go
AWS experience (IAM, VPC, KMS, GuardDuty, CloudTrail) and working fluency in at least one of Azure or GCP
Kubernetes detection experience: audit logs, runtime telemetry, and workload identity
Knowledge of endpoint security (MacOS) and detection and response techniques
Hands-on incident experience: you've been on call, led incidents, and written postmortems
Strong written and verbal communication
A clear point of view on AI/LLM security and hands-on experience defending relevant threats
Bonus: prior experience with LLM red-teaming, agent sandbox research, or other AI-relevant security threat defense
