Detection & Response Engineer — Incident Lead

Braintrust; United States; On-site; USD 170,000 - 230,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

Daily lunch, snacks, beverages

Flexible time off

Competitive salary and equity

Wifi & cellphone stipend

Job summary

Braintrust is seeking a Detection and Response engineer to design and build systems that identify, analyze, and eradicate threats across our stack. You’ll run security operations, lead incident response, and stay ahead with real-time threat intelligence.

Join a small team with outsized capabilities and high impact. You’ll implement telemetry pipelines across cloud environments, improve detections for attacks and anomalies, and own the alert pipeline end-to-end while maintaining trustworthy

Qualifications

• Proficient in modern backend languages and security tooling.
• Experience with incident responses and postmortems.
• Strong communication skills and ability to document findings.
• Hands-on experience defending AI/LLM threats.

Responsibilities

• Build security telemetry pipelines across cloud environments and endpoints.
• Continuously improve detections for attacks and anomalous behavior.
• Own the alert pipeline end-to-end with high signal-to-noise ratio.
• Lead incident response, triage, containment, and postmortems.
• Hunt for threats and develop detections from evidence.
• Build agents that triage alerts with human-in-the-loop controls.
• Drive vulnerability response and remediation across infrastructure.

Skills

Python/TypeScript/Go

Incident response

Communication

AI/LLM security

Tools

AWS

Azure or GCP

Job description

Braintrust is seeking a Detection and Response engineer to design and build systems that identify, analyze, and eradicate threats across our stack. You’ll run security operations, lead incident response, and stay ahead with real-time threat intelligence.

Join a small team with outsized capabilities and high impact. You’ll implement telemetry pipelines across cloud environments, improve detections for attacks and anomalies, and own the alert pipeline end-to-end while maintaining trustworthy