Detection and Response Engineer

Braintrust Data, Inc.; San Francisco, New York, Seattle (CA, NY, WA); On-site; USD 180,000 - 260,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

Daily lunch, snacks, and beverages

Flexible time off

Competitive salary and equity

Wifi & cellphone stipend

Job summary

Braintrust Data, Inc. is seeking a Detection and Response engineer to design and build systems that identify, analyze, and eradicate threats across the Braintrust stack. You’ll practice detection-as-code and lead incident response, while staying ahead with real-time threat intelligence.

You’ll own telemetry pipelines across cloud environments, improve detections, run on-call, and build tools to triage alerts and drive durable security improvements.

Qualifications

• Proficient in Python, TypeScript or Go with backend experience.
• Experience with AWS (IAM, VPC, KMS, GuardDuty, CloudTrail) and Azure or GCP.
• Kubernetes detection experience: audit logs, runtime telemetry.
• Knowledge of endpoint security (MacOS) and detection/response techniques.
• Hands-on incident experience: on-call, led incidents, wrote postmortems.
• Strong written and verbal communication.
• Clear stance on AI/LLM security with hands-on defense experience.
• Bonus: LLM red-teaming or AI threat defense experience.

Responsibilities

• Build security telemetry pipelines across cloud environments (ECS/K8s), CI/CD, identity, endpoints and agent workloads.
• Continuously improve detections for attacks, abuse, and anomalies.
• Own the alert pipeline end-to-end and maximize signal-to-noise.
• Lead incident response and participate in on-call: triage, scope, contain, remediate, then write postmortems to drive durable improvements.
• Hunt proactively for threats and build tooling to create new detections.
• Build agents that triage alerts, enrich findings, gather evidence, and scope incidents with human-in-the-loop controls.
• Run vulnerability response and drive remediation across infrastructure.

Skills

Backend development in Python/TypeScr/

Cloud platforms (AWS/Azure/GCP)

Kubernetes detection/telemetry

Endpoint security (MacOS)

Incident response/on-call

Communication skills

AI/LLM security

Postmortems/root-cause analysis

Tools

AWS IAM/VPC/KMS/GuardDuty/CloudTrail

Kubernetes

Docker

Job description

Careers

Detection and Response Engineer

San Francisco, New York City, Seattle

About the company

Braintrust is the agent observability platform. By actively applying intelligence to agent traces and automatically surfacing the most critical patterns, Braintrust gives teams the visibility to understand how agents behave in production and the tools to improve them.
Teams at Notion, Stripe, Box, OpenAI, and Cloudflare use Braintrust to trace their agents, find the issues in their observability data, and run evals that tell them how to improve.

About the role

We’re looking for a Detection and Response engineer to design and build systems that identify, analyze, and eradicate threats across the Braintrust stack. You’ll practice detection-as-code, run security operations with agents, lead incident response, and stay ahead of the curve incorporating real-time threat intelligence. Have a big impact with a small team that has outsized capabilities.

What you'll do

• Build security telemetry pipelines across cloud execution environments (ECS/K8s), CI/CD systems, identity systems, endpoints, and agentic workloads
• Continuously improve detections for attacks, abuse, and anomalous behavior
• Own the alert pipeline end-to-end and keep signal-to-noise high
• Lead incident response and participate in on-call: triage, scope, contain, and remediate incidents, then write postmortems that produce durable improvements
• Hunt proactively for threats and build the tooling for turning evidence into new detections
• Build agents that triage alerts, enrich findings, gather evidence, and scope incidents, with human-in-the-loop controls and evals that keep the automation trustworthy
• Run vulnerability response, evaluating impact and driving remediation across our infrastructure

Ideal candidate credentials

• Proficient in modern backend technologies and comfortable writing real code in Python, TypeScript, or Go
• AWS experience (IAM, VPC, KMS, GuardDuty, CloudTrail) and working fluency in at least one of Azure or GCP
• Kubernetes detection experience: audit logs, runtime telemetry, and workload identity
• Knowledge of endpoint security (MacOS) and detection and response techniques
• Hands-on incident experience: you’ve been on call, led incidents, and written postmortems
• Strong written and verbal communication
• A clear point of view on AI/LLM security and hands-on experience defending relevant threats
• Bonus: prior experience with LLM red-teaming, agent sandbox research, or other AI-relevant security threat defense

Benefits include

• Medical, dental, and vision insurance
• Daily lunch, snacks, and beverages
• Flexible time off
• Competitive salary and equity
• Wifi & cellphone stipend

Equal opportunity

Braintrust is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status.