Detection & Incident Response Security Engineer

Anthropic; Washington, Baltimore (District of Columbia, MD); Hybrid; USD 300,000 - 405,000; Full time

Job summary

Anthropic in Washington, DC is seeking a Detection and Response engineer to lead incident response across our stack, develop tooling (potentially with LLMs) to improve detection, investigation, and response, and collaborate with security and engineering teams.

The role requires 3+ years of software engineering with security experience or 5+ years in detection/IR, strong cloud/SaaS experience, Python/SQL proficiency, and knowledge of EDR/SIEM/SOAR. On-call rotation is included.

Qualifications

• 3+ years of software engineering, with security experience a plus
• 5+ years of detection engineering or incident response
• Solid understanding of cloud environments and operations
• Experience working with engineering teams in a SaaS environment
• Exceptional communication and collaboration skills
• Ability to lead projects with little guidance
• Ability to pick up new languages and technologies quickly
• Experience handling security incidents and investigating anomalies in a team
• Knowledge of EDR, SIEM, SOAR or related security tools

Responsibilities

• Lead cybersecurity Incident Response across Anthropic’s tech stack
• Develop and deploy tooling to enhance detection, investigation, and response
• Create and optimize detections, playbooks, and workflows
• Review Incident Response metrics and drive continuous improvement
• Work cross-functionally with security and engineering teams
• Participate in an on‑call rotation

Skills

Security incident response

Cloud environments

SaaS environments

Communication & collaboration

Project leadership

New languages & technologies

Incident investigation

EDR/SIEM/SOAR

Education

Bachelor’s degree or equivalent

Tools

Kubernetes

Python

SQL

Job description

Anthropic in Washington, DC is seeking a Detection and Response engineer to lead incident response across our stack, develop tooling (potentially with LLMs) to improve detection, investigation, and response, and collaborate with security and engineering teams.

The role requires 3+ years of software engineering with security experience or 5+ years in detection/IR, strong cloud/SaaS experience, Python/SQL proficiency, and knowledge of EDR/SIEM/SOAR. On-call rotation is included.