Detection and Response Engineer
Braintrust11 hours ago
Responsibilities
- Build security telemetry pipelines across cloud execution environments, CI/CD systems, identity systems, endpoints, and agentic workloads.
- Continuously improve detections for attacks, abuse, and anomalous behavior.
- Own the alert pipeline end-to-end while maintaining a high signal-to-noise ratio.
- Lead incident response, participate in on-call, and triage, scope, contain, and remediate incidents.
- Write incident postmortems that drive durable security improvements.
- Proactively hunt for threats and build tooling that turns evidence into new detections.
- Build agents that triage alerts, enrich findings, gather evidence, and scope incidents with human-in-the-loop controls and evaluations.
- Run vulnerability response, evaluate impact, and drive remediation across infrastructure.
Requirements
- Proficiency in modern backend technologies and the ability to write production code in Python, TypeScript, or Go.
- AWS experience with IAM, VPC, KMS, GuardDuty, and CloudTrail, plus working fluency in at least one of Azure or GCP.
- Experience with Kubernetes detection, including audit logs, runtime telemetry, and workload identity.
- Knowledge of endpoint security on MacOS and detection and response techniques.
- Hands-on incident experience, including on-call participation, incident leadership, and postmortem writing.
- Strong written and verbal communication skills.
- A clear point of view on AI/LLM security and hands-on experience defending relevant threats.
- Prior experience with LLM red-teaming, agent sandbox research, or other AI-relevant security threat defense is a bonus.
Benefits
- Medical, dental, and vision insurance.
- Daily lunch, snacks, and beverages.
- Flexible time off.
- Competitive salary and equity.
- WiFi and cellphone stipend.
Tech Stack
Categories
About Braintrust
Braintrust builds an AI observability and evaluation platform for teams deploying LLM-powered applications. It unifies evals and production monitoring to compare models, test prompts, catch regressions, and turn real usage data into better releases; it can be self-hosted or used as a managed service. Customers include Notion, Stripe, Zapier, Vercel, and Ramp, and the software is sold by subscription to engineering and data teams.