2 months ago
Stockholm, SwedenStaff+
Responsibilities
- Build the detection engineering platform, including telemetry pipelines, detections-as-code, automated triage, and response playbooks.
- Design and own a 24/7 security incident response process supported by a small human and agent team.
- Lead high-severity incidents through detection, containment, eradication, post-mortem, and follow-through.
- Proactively hunt across corporate, production, and AI-agent surfaces and convert findings into durable detections.
- Define and build world-class detection and response capabilities for an AI-native company.
Requirements
- Require 8+ years in detection engineering, incident response, or threat hunting, including at least 3 years at staff or principal level.
- Strong software engineering background with experience building detections as code.
- Deep experience with cloud telemetry from GCP, AWS, or Cloudflare; endpoint EDR; identity logs; and modern SIEM/data-lake stacks such as Panther, Elastic, Snowflake, or ClickHouse.
- Battle-tested incident commander with experience leading real high-severity incidents from first alert through public post-mortem.
- Experience with MITRE ATT&CK, threat intelligence, purple teaming, and red team collaboration.
- Detection for LLM or agent abuse, prompt injection at scale, or insider risk in AI-augmented engineering organizations is a bonus.
Tech Stack
AWSClickHouseCloudflareGitHub ActionsGoGoogle BigQueryGoogle Cloud PlatformGrafanaReactRustSnowflakeTerraformTypeScript
Categories
About Lovable
Lovable builds an AI-native software creation platform that lets people build apps and websites by chatting with AI, along with tools such as gptengineer.app. It serves solopreneurs, small businesses, and enterprise teams, and users have created over 60 million projects since its November 2024 launch, with customers including Adidas and Zendesk. The company is privately held and headquartered in Stockholm.