17 hours ago
Base Salary
$240k - $290k/yr
Responsibilities
- Own the detection and response program, including logging, alerting, triage, containment, recovery, and incident metrics.
- Write and tune detections as code across cloud environments, Kubernetes, identity systems, endpoints, and SaaS.
- Lead incident investigations from initial alert through containment, forensics, recovery, and post-incident review.
- Build automation for enrichment, correlation, containment actions, evidence collection, and other triage work.
- Monitor AI agents and developer tooling and develop appropriate telemetry and controls.
- Partner with platform and research engineers to implement logging and response playbooks in new systems.
- Run threat hunts and tabletop exercises and remediate identified issues.
- Provide security evidence for SOC 2, ISO 27001, and enterprise customer reviews with the GRC team.
- Participate in a security-incident on-call rotation.
Requirements
- Hands-on experience triaging live alerts, leading investigations, and documenting incident outcomes.
- Experience building and tuning detections in a modern SIEM, ideally managed as code.
- Knowledge of attacker activity in cloud and Kubernetes environments, including IAM abuse, container escape, credential theft, and supply chain compromise.
- Ability to write Python, TypeScript, Rust, or another programming language to automate response work and integrate security tools.
- Familiarity with at least one major cloud platform and Kubernetes audit logs, RBAC, and workload identity.
- Strong written communication for incident timelines, detection documentation, and leadership updates.
- Sound judgment about alerting, automation, and escalation decisions.
- Preferred experience includes monitoring GPU or HPC-style infrastructure, research environments, AI agents, LLM tooling, or MCP servers; cloud forensics; and publishing open-source detection content.
Benefits
- Remote hiring is available, with offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv.
- The role includes participation in a security-incident on-call rotation.
- Runway states its commitment to pay equity, diversity, and equal opportunity.
Tech Stack
Categories
About Runway
Runway builds generative video and multimodal AI tools—text-to-video, image-to-video, advanced video editing, and real-time agents—delivered via web apps and APIs for creators, studios, and enterprises. Its business model centers on subscriptions, usage-based credits, and licensing; notable releases include Gen-4.5, the GWM-1 world model, and a robotics SDK. Founded in 2018 and headquartered in New York, the company is privately held.