Detection & Response Engineer

Runway; United States; Hybrid; USD 150,000 - 190,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

Unlimited PTO

401k matching

Remote stipend

Parental leave

L&D stipend

Wellness stipend

Job summary

Runway is seeking a Detection & Response Engineer to own how we find and stop attacks across our infrastructure, research environment, and products. You’ll write detections as code, automate response, and shape the program end-to-end with ownership from logging to incident closure.

You’ll partner with platform and research teams, build telemetry, and drive gated security reviews. Strong cloud/Kubernetes experience and incident response mindset are required.

Qualifications

• Experience building and tuning detections in a modern SIEM, ideally managed as code.
• Hands-on incident response experience: triage live alerts, investigations, and post-incident reports.
• Familiarity with cloud platforms (AWS/GCP/Azure) and Kubernetes at an audit/logging level.
• Experience monitoring GPU/HPC-like infrastructure or research environments with large datasets.
• Ability to write Python/Typescript/Rust to automate response workflows and integrate security tools.
• Experience with AI/ML tooling or guards for AI agents in production environments.

Responsibilities

• Own detection program end to end: logging, alerting, triage, and recovery.
• Write and tune detections as code across cloud environments, Kubernetes, identity systems, endpoints, and SaaS.
• Lead incident response from first alert through containment and forensics; produce post-incident reviews.

Skills

Detections as code

Incident response

Cloud security

Kubernetes

Python scripting

Threat hunting

Tools

AWS

GCP

Azure

SIEM

Job description

• Runway is hiring a Detection & Response Engineer to own how we find and stop attacks against our infrastructure, our research environment and our products
• Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product
• The environment includes research compute, large training datasets, a fast-moving build pipeline and engineers who work inside AI-assisted tooling every day
• Each of those changes what an attack looks like and what you need to see to catch it
• You’ll join the Security team and build our detection and response program the way an engineer would: detections as code, response as automation, evidence as something you can query
• This is a role with real ownership: you’ll own the detection program end to end, from what we log to how quickly we close an incident
• You’ll report to the head of security, partner with engineers across platform and research, and shape how this function grows from here
• Own detection and response end to end: what we log, what we alert on, how we triage and how we recover
• Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume
• Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read
• Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit
• Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls
• Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one
• Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find
• Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team
• Participate in an on-call rotation for security incidents

Benefits

• 100% medical, dental, and vision coverage: We cover 100% of medical, dental and vision for our US employees AND their dependents. Based on the plans selected, we have complimentary mental health benefits and a free One Medical membership
• Unlimited days of PTO: We have unlimited PTO with a minimum of 15 days a year. We also have a paid sabbatical program after employees have been with Runway for 3 years and again after 5 years. And of course, we can’t forget about Summer Fridays
• 401k Matching, 3% matching: Plan for the future! We provide a 3% 401K match for our US based employees
• Remote $250 stipend: All of our employees outside of commuting distance to the office, can expense up to $250 per month on co-working spaces, lunch or groceries, and internet connection
• Donations supporting our community: Beyond our employees, we have a commitment to our communities. Every quarter, Runway employees choose an organization for the company to support through a donation
• Custom setup, tech setup stipend: In addition to the choice of laptop, all employees get a stipend to customize their tech set up as they want
• Parental leave for all parents: We offer 16 weeks of fully paid parental leave plus a gradual return to work plan. This coverage is for all parents, regardless of how a child is brought into the family
• L&D $600 stipend: We’re investing in our employees’ long term growth by giving every employee $600 per year to spend on their personal or professional development. That means conferences, courses, and books, oh my!
• Wellness $600 stipend: We set ambitious goals and work hard to achieve them, so we believe it’s important to invest in employees’ mental and physical health. The $600 annual wellness stipend can be used for anything from therapy sessions to gym memberships

Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logsFamiliarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identityComfort writing Python, Typescript, Rust or another language to automate response work and connect security toolsClear writing. Incident timelines, detection documentation and updates to leadership are all part of the jobJudgment about what to alert on, what to automate and when to wake someone upExperience building and tuning detections in a modern SIEM, ideally managed as codeHands-on incident response experience: you’ve triaged live alerts, led investigations and written up what happened afterwardExperience monitoring GPU or HPC-style infrastructure, or research environments with large datasetsExperience building detections or guardrails for AI agents, LLM tooling or MCP serversCloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custodyPublished open source detection content