Remote
Detection & Response Engineer
О роли
Описание вакансии
About the company
- Runway builds AI to simulate the world by merging art and science
- World models at the frontier of AI progress
- Offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv; remote hiring open
Responsibilities
- Own detection and response end to end: logging, alerting, triage, recovery
- Write and tune detections as code across cloud environments, Kubernetes, identity systems, endpoints and SaaS; measure coverage and precision
- Lead incident response from first alert through containment and forensics, write post-incident reviews
- Build automation for triage: enrichment, correlation, containment actions, evidence collection; use LLM-based tooling
- Monitor AI agents and developer tooling, turn into telemetry and controls
- Partner with platform and research engineers so new systems ship with logging and response playbooks
- Run threat hunts and tabletop exercises
- Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and customer security reviews
- Participate in on-call rotation for security incidents
Requirements
- Hands-on incident response experience: triaging live alerts, leading investigations, writing up results
- Experience building and tuning detections in a modern SIEM, ideally managed as code
- Knowledge of attacker movement through cloud and Kubernetes (IAM abuse, container escape, credential theft, supply chain compromise)
- Comfort writing Python, TypeScript, Rust or another language to automate response work
- Familiarity with a major cloud platform and Kubernetes (audit logs, RBAC, workload identity)
- Clear writing for incident timelines, detection documentation, leadership updates
- Judgment about alerting, automation and escalation
Nice to have
- Monitoring GPU or HPC-style infrastructure, or research environments with large datasets
- Detections or guardrails for AI agents, LLM tooling or MCP servers
- Cloud forensics: disk and memory acquisition, audit trail reconstruction, chain of custody
- Published open source detection content
Стек и навыки
С чем работаем