AI-Driven Detection & Response Engineer

TikTok; San Jose (CA); On-site; USD 128,000 - 256,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) with company match

Paid parental leave

Disability coverage

Life insurance

Wellbeing benefits

Paid holidays

Job summary

TikTok is seeking a Security Engineer in Detection & Response for its Global Security Organization. The role is based in San Jose and focuses on end-to-end detection engineering, streaming detection with ML, and AI agent security across enterprise-scale telemetry.

You will own rules, models, and pipelines, analyze large datasets, and collaborate on threat hunting, incident response, and improved logging to reduce risk across the platform used by 1+ billion users.

Qualifications

• 5+ years of hands-on information security or cybersecurity engineering.
• Experience processing and correlating large-scale multi-source security telemetry.
• Strong data analysis, statistics and applied ML for anomaly detection.
• Hands-on experience building detection rules or hunting queries for SIEM/EDR.
• Knowledge of AI Agent security risks and hardening (e.g., prompt injection).

Responsibilities

• Own detection rules, behavioral models, and pipelines end-to-end—from log ingestion through alerting.
• Build streaming detection pipelines that combine statistical methods and unsupervised learning.
• Design detection capabilities for AI agents based on the MITRE ATLAS framework.
• Detect emerging attack patterns: agent abuse, unauthorized tool calls, agent escape.
• Monitor agent-LLM-tool-data interactions to catch instruction manipulation and data exfiltration.
• Retrospective threat hunting on cold storage and historical logs for post-incident analysis.
• Improve signal-to-noise ratio and shape logging standards for LLM/agent systems.

Skills

Security engineering

Telemetry analysis

ML for anomaly detection

SIEM/EDR queries

AI security risks knowledge

Job description

TikTok is seeking a Security Engineer in Detection & Response for its Global Security Organization. The role is based in San Jose and focuses on end-to-end detection engineering, streaming detection with ML, and AI agent security across enterprise-scale telemetry.

You will own rules, models, and pipelines, analyze large datasets, and collaborate on threat hunting, incident response, and improved logging to reduce risk across the platform used by 1+ billion users.