Detection & Response Security Engineer Lead

Aircall; San Francisco (CA); On-site; USD 180,000 - 220,000; Full time

Benefits offered by this job

Competitive salary & benefits

Job summary

Aircall is seeking a Senior Security Engineer, Detection and Response to build and scale Aircall's threat detection and response capabilities. You will own detections from scratch, drive investigations, and mature the detection program across AWS accounts.

Expect heavy Python and Terraform development, with collaboration across security, product, and infrastructure teams. Two-thirds of the work is software/platform engineering; one-third is investigation, incident response, and threat hunting.

Qualifications

• 5+ years of hands-on experience in security operations, detection engineering, incident response, threat hunting, or similar fields.
• Production-grade Python and Terraform; capable of building detections and logging pipelines in production.
• Deep knowledge of adversarial tactics, techniques, and procedures (ATT&CK).
• Experience with SIEM/log analytics platforms and data lake tech (OpenSearch/Elasticsearch, Datadog, etc.).
• Cloud-first experience across AWS/Azure/GCP; owns security infra in production.
• Experience responding to incidents in production environments and conducting post-incident reviews.

Responsibilities

• Lead end-to-end development of detection logic from threat modeling to deployment across logs and cloud sources.
• Own the security data platform end to end, including SIEM ingestion pipelines and cost envelope.
• Write production Python and Terraform code for detections and automation weekly.
• Lead incident response, containment, remediation, and root cause analysis; drive post-incident reviews.
• Collaborate with Engineering, Product, Fraud, Privacy and Legal to improve detections and protections.
• Stay current on attacker techniques (MITRE ATT&CK, threat intel) and propose new detection patterns.

Skills

Threat hunting

Incident response

Security operations

Python programming

Terraform

Cloud security (AWS/Azure/GCP)

Communication skills

Tools

Terraform

OpenSearch

Elasticsearch

Datadog

AWS

Azure

GCP

Job description

Aircall is seeking a Senior Security Engineer, Detection and Response to build and scale Aircall's threat detection and response capabilities. You will own detections from scratch, drive investigations, and mature the detection program across AWS accounts.

Expect heavy Python and Terraform development, with collaboration across security, product, and infrastructure teams. Two-thirds of the work is software/platform engineering; one-third is investigation, incident response, and threat hunting.