Detection & Response Security Engineer (Hybrid)

Anthropic Limited; San Francisco (CA); Hybrid; USD 300,000 - 405,000; Full time

Job summary

Anthropic Limited in San Francisco, CA is seeking a Detection and Response engineer to build, monitor, and improve security capabilities across the technology stack. You will lead incident response and develop advanced tooling, including potential use of large language models, to enhance detection, investigation, and response.

The role emphasizes collaboration with researchers and engineers, rapid incident handling, and on-call readiness.

Qualifications

• 3+ years of software engineering experience; security experience is a plus.
• 5+ years in detection engineering, incident response, or threat hunting.
• Strong understanding of cloud environments and SaaS operations.
• Experience collaborating with engineering teams in a SaaS setting.
• Excellent communication and collaboration skills; able to lead with minimal guidance.
• Ability to quickly learn new languages and technologies.
• Proven experience handling security incidents and investigations in a team.
• Knowledge of EDR, SIEM, SOAR, or related security tools.

Responsibilities

• Lead cybersecurity incident response across multiple domains and layers of Anthropic’s stack.
• Develop and deploy tooling, potentially leveraging LLMs, to enhance detection and response.
• Create and optimize detections, playbooks, and workflows for rapid incident handling.
• Review incident response metrics and procedures to drive improvement.
• Collaborate cross-functionally with security and engineering teams.
• Participate in on-call rotations as part of the role.

Skills

Software engineering

Incident response

Detection engineering

Cloud environments

SaaS

Communication

Project leadership

Learning languages

Security incidents investigations

Python

Education

Bachelor’s degree

Tools

EDR

SIEM

SOAR

Kubernetes

Job description

Anthropic Limited in San Francisco, CA is seeking a Detection and Response engineer to build, monitor, and improve security capabilities across the technology stack. You will lead incident response and develop advanced tooling, including potential use of large language models, to enhance detection, investigation, and response.

The role emphasizes collaboration with researchers and engineers, rapid incident handling, and on-call readiness.