Senior Detection & Response Engineer — Build Threat Tools

Anthropic; Zürich; Hybrid; CHF 150,000 - 210,000; Full time

Benefits offered by this job

Competitive compensation

Equity donation matching

Generous vacation

Flexible working hours

Office space in Zürich

Job summary

Anthropic, Zürich-based, seeks a seasoned security professional to join the Detection and Response team. You will drive incident response across domains, build tooling with large language models, and refine detections, playbooks, and workflows to accelerate containment and recovery.

You will collaborate with security and research teams, participate in on‑call rotations, and guide projects with limited supervision. A strong cloud and SaaS security background is essential.

Qualifications

• Experience handling security incidents and investigations as part of a team.
• Working knowledge of security tooling such as EDR, SIEM, SOAR.
• Solid understanding of cloud environments and SaaS operations.
• Experience collaborating with engineering teams in a SaaS environment.
• Proficiency with Python and SQL.
• Strong communication and collaboration skills.
• Ability to lead projects with minimal guidance.
• Ability to learn new languages and technologies quickly.

Responsibilities

• Lead incident response across multiple domains and threat scenarios.
• Build and deploy tooling to improve detection and response.
• Create and tune detections, playbooks, and workflows for rapid containment.
• Review incident metrics and procedures and drive improvements.
• Collaborate across security and engineering teams.
• Participate in an on‑call rotation.

Skills

Incident response

EDR tooling

SIEM

SOAR

Cloud environments

SaaS engineering

Python

SQL

Team leadership

Communication

Learn quickly

Education

Bachelor’s degree

Tools

EDR

SIEM

SOAR

Kubernetes

Job description

Anthropic, Zürich-based, seeks a seasoned security professional to join the Detection and Response team. You will drive incident response across domains, build tooling with large language models, and refine detections, playbooks, and workflows to accelerate containment and recovery.

You will collaborate with security and research teams, participate in on‑call rotations, and guide projects with limited supervision. A strong cloud and SaaS security background is essential.