Detection and Response Engineer
Braintrust14 days ago
Responsibilities
- Build security telemetry pipelines across ECS/Kubernetes, CI/CD systems, identity systems, endpoints, and agentic workloads.
- Continuously improve detections for attacks, abuse, and anomalous behavior while owning the alert pipeline and maintaining high signal-to-noise.
- Lead incident response and participate in on-call by triaging, scoping, containing, and remediating incidents, followed by postmortems.
- Proactively hunt for threats and build tooling that converts evidence into new detections.
- Build agents that triage alerts, enrich findings, gather evidence, and scope incidents with human-in-the-loop controls and evaluations.
- Run vulnerability response by evaluating impact and driving remediation across infrastructure.
Requirements
- Proficiency with modern backend technologies and the ability to write production code in Python, TypeScript, or Go.
- AWS experience with IAM, VPC, KMS, GuardDuty, and CloudTrail, plus working fluency in Azure or GCP.
- Kubernetes detection experience involving audit logs, runtime telemetry, and workload identity.
- Knowledge of endpoint security on macOS and detection and response techniques.
- Hands-on incident experience, including on-call participation, incident leadership, and postmortem writing.
- A clear point of view on AI/LLM security and hands-on experience defending relevant threats.
- Strong written and verbal communication.
- Prior experience with LLM red-teaming, agent sandbox research, or other AI-relevant security threat defense is a bonus.
Benefits
- Medical, dental, and vision insurance.
- Daily lunch, snacks, and beverages.
- Flexible time off.
- Competitive salary and equity.
- WiFi and cellphone stipend.
Tech Stack
Categories
About Braintrust
Braintrust builds an AI observability and evaluation platform for teams deploying LLM-powered applications. It unifies evals and production monitoring to compare models, test prompts, catch regressions, and turn real usage data into better releases; it can be self-hosted or used as a managed service. Customers include Notion, Stripe, Zapier, Vercel, and Ramp, and the software is sold by subscription to engineering and data teams.