Principal Detection & Response Engineer – AI Security

Lovable; Stockholms kommun; On-site; SEK 1,000,000 - 1,400,000; Full time

Job summary

Lovable, an AI-powered software platform with a Stockholm origin, seeks a senior Detection Engineer to fortify security across corporate, production, and AI-agent surfaces.

You will build detections-as-code, pipelines, and automated triage while designing 24/7 incident response processes, leading incidents end-to-end, and proactively hunting for threats to turn findings into lasting detections.

Qualifications

• 8+ years in detection engineering, incident response, or threat hunting, including staff/principal level experience.
• Strong engineering background; detections implemented as code, not SIEM saved searches.
• Deep experience with cloud telemetry (GCP/AWS/Cloudflare), endpoint EDR, identity logs, and SIEM/data-lake stacks.
• Proven ability to lead high-severity incidents from first alert to post-mortem.
• Knowledge of MITRE ATT&CK, threat intel, purple-teaming, and red-team collaboration.
• Bonus: detection for LLM/agent abuse, prompt injection, or insider risk in AI-native orgs.

Responsibilities

• Build the detection engineering platform—pipelines, detections-as-code, automated triage, and response playbooks.
• Design and own security incident response process with 24/7 coverage and a small, high-leverage team.
• Lead incidents end-to-end: detection, containment, eradication, post-mortem, and follow-through.
• Hunt proactively across corporate, production, and AI-agent surfaces and turn findings into durable detections.
• Define world-class D&R for an AI-native company and build it.

Skills

Detections engineering

Incident response

Threat hunting

Detections-as-code

MITRE ATT&CK

Purple-teaming

Red team collab

Cloud telemetry

EDR/log analysis

LLM abuse detection

Tools

Panther

Elastic

Snowflake

ClickHouse

GitHub Actions

Grafana

Terraform

Job description

Lovable, an AI-powered software platform with a Stockholm origin, seeks a senior Detection Engineer to fortify security across corporate, production, and AI-agent surfaces.

You will build detections-as-code, pipelines, and automated triage while designing 24/7 incident response processes, leading incidents end-to-end, and proactively hunting for threats to turn findings into lasting detections.