Detection & Response Engineer — Incident Lead & Threat Hunting

Braintrust Data, Inc.; San Francisco, New York, Seattle (CA, NY, WA); On-site; USD 180,000 - 260,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

Daily lunch, snacks, and beverages

Flexible time off

Competitive salary and equity

Wifi & cellphone stipend

Job summary

Braintrust Data, Inc. is seeking a Detection and Response engineer to design and build systems that identify, analyze, and eradicate threats across the Braintrust stack. You’ll practice detection-as-code and lead incident response, while staying ahead with real-time threat intelligence.

You’ll own telemetry pipelines across cloud environments, improve detections, run on-call, and build tools to triage alerts and drive durable security improvements.

Qualifications

• Proficient in Python, TypeScript or Go with backend experience.
• Experience with AWS (IAM, VPC, KMS, GuardDuty, CloudTrail) and Azure or GCP.
• Kubernetes detection experience: audit logs, runtime telemetry.
• Knowledge of endpoint security (MacOS) and detection/response techniques.
• Hands-on incident experience: on-call, led incidents, wrote postmortems.
• Strong written and verbal communication.
• Clear stance on AI/LLM security with hands-on defense experience.
• Bonus: LLM red-teaming or AI threat defense experience.

Responsibilities

• Build security telemetry pipelines across cloud environments (ECS/K8s), CI/CD, identity, endpoints and agent workloads.
• Continuously improve detections for attacks, abuse, and anomalies.
• Own the alert pipeline end-to-end and maximize signal-to-noise.
• Lead incident response and participate in on-call: triage, scope, contain, remediate, then write postmortems to drive durable improvements.
• Hunt proactively for threats and build tooling to create new detections.
• Build agents that triage alerts, enrich findings, gather evidence, and scope incidents with human-in-the-loop controls.
• Run vulnerability response and drive remediation across infrastructure.

Skills

Backend development in Python/TypeScr/

Cloud platforms (AWS/Azure/GCP)

Kubernetes detection/telemetry

Endpoint security (MacOS)

Incident response/on-call

Communication skills

AI/LLM security

Postmortems/root-cause analysis

Tools

AWS IAM/VPC/KMS/GuardDuty/CloudTrail

Kubernetes

Docker

Job description

Braintrust Data, Inc. is seeking a Detection and Response engineer to design and build systems that identify, analyze, and eradicate threats across the Braintrust stack. You’ll practice detection-as-code and lead incident response, while staying ahead with real-time threat intelligence.

You’ll own telemetry pipelines across cloud environments, improve detections, run on-call, and build tools to triage alerts and drive durable security improvements.