Security Engineer, Detection & Response

Brain Co.; San Francisco (CA); On-site; USD 180,000 - 250,000; Full time

Job summary

Brain Co. is seeking a Security Engineer, Detection & Response to build and operate our detection and response capabilities as the company scales.

Reporting to the Head of Security, you will collaborate with engineering, IT, and security teams to protect environments and respond to incidents. This engineering-focused role emphasizes building high-signal detections, automating triage, guiding incident response, and turning lessons into safer defaults across the organization, with significant

Qualifications

• Demonstrated capability in security engineering, detection engineering, or incident response.
• Hands-on experience investigating security incidents or suspicious behavior in complex environments.
• Practical experience with EDR, SIEM, SOAR, log-management, or equivalent detection-and-response tooling.
• Ability to write code and build software automation or detections in at least one relevant scripting or query language.
• Strong understanding of modern cloud infrastructure and SaaS security principles.
• Sound risk-based judgment when prioritizing threats and operational tasks.
• Ability to make sound, timely decisions with incomplete information during active incidents.
• Clear communication and cross-functional collaboration skills during high-pressure situations.

Responsibilities

• Design, build, and maintain automation, playbooks, and systems for timely triage, investigation, and incident response.
• Develop and refine high-signal detections so security findings are actionable and noise is minimized.
• Integrate security telemetry and tooling across cloud and application stack for consistent investigation and self-service triage.
• Lead cross-functional incident response across applications, cloud infrastructure, endpoints, identity, and internal services.
• Translate incident data and response metrics into secure-by-design improvements with product and infra teams.
• Continuously evaluate response procedures and partner across teams to close gaps and improve the operating model.

Skills

Security engineering

Detection engineering

Incident response

EDR/SIEM/SOAR

Scripting

Cloud security

Communication

Tools

Kubernetes

Job description

Our Mission

Rebuild how the world works, to make institutions work better for the people they serve.

About Brain Co.

Brain Co. builds AI-native operating systems for large, regulated institutions. Each system is built for a specific industry, powered by agents that push real workflows forward. Underneath it all is Atlas, our proprietary platform that keeps customers in control, secure by design, and never locked into one model.

Why Now

Brain Co. is entering its next phase of production deployments on a national scale with an elite team built from Palantir, Google, Meta, and Nvidia, and a growing footprint across government, insurance, health, and financial services.

Joining now means shaping both the company and a new category of applied AI. Every project here ships to production and is expected to create measurable customer value and impact.

You’ll work alongside exceptional peers on some of the hardest problems in applied AI. It’s the kind of work you’ll still be proud of in ten years from now.

About the Role

We are looking for a Security Engineer, Detection & Response to build and operate our detection and response capabilities as Brain Co. expands. Reporting directly to the Head of Security, you will partner closely with engineering, infrastructure, infrastructure security, IT, and operational teams to protect our environments and respond effectively to security incidents.

This is an engineering-focused builder role rather than a passive alert-monitoring position. You will strengthen our security posture from the ground up: designing high-signal detections, automating triage and investigation workflows, leading cross-functional incident response, and converting incident findings into safer engineering defaults across the company.

The program is early enough that your judgment will shape the tooling, workflows, metrics, and operating model—not just the alerts you investigate. You will have significant autonomy to improve signal quality, streamline integrations, and turn incident lessons into stronger engineering defaults across the organization.

What You’ll Build & Own

• Design, build, and maintain automation, playbooks, and systems for timely triage, investigation, and incident response, using sound software engineering practices and modern AI tools where they add value.

• Develop and refine high-signal detections so security findings are actionable and noise is minimized.

• Integrate security telemetry and tooling across our cloud and application stack to enable consistent investigation and self-service triage.

• Lead cross-functional incident response across applications, cloud infrastructure, endpoints, identity, and internal services.

• Translate incident data and response metrics into secure-by-design improvements alongside product and infrastructure teams.

• Continuously evaluate response procedures and partner across engineering, infrastructure security, IT, and operational teams to close gaps and improve the operating model.

What We’re Looking For

• Demonstrated capability in security engineering, detection engineering, or incident response.

• Hands-on experience investigating security incidents or suspicious behavior in complex environments.

• Practical experience with EDR, SIEM, SOAR, log-management, or equivalent detection-and-response tooling.

• Ability to write code and build software automation or detections in at least one relevant scripting or query language.

• Strong understanding of modern cloud infrastructure and SaaS security principles.

• Sound risk-based judgment when prioritizing threats and operational tasks.

• Ability to make sound, timely decisions with incomplete information during active incidents.

• Clear communication and cross-functional collaboration skills during high-pressure situations.

Preferred Experience

• Building self-serve security triage automation or AI-assisted response capabilities.

• Threat hunting, digital forensics, threat intelligence, or infrastructure-as-code security controls.

• Investigating complex security events within containerized or Kubernetes-based cloud environments.

• Translating security incident trends into architectural or systemic engineering improvements.

• Experience navigating security challenges in fast-paced, high-growth startup environments.

On-Call Expectation

This position includes participation in a regular on-call rotation to support rapid response to critical security incidents and maintain operational resilience.

Equal Opportunity and Accessibility

Brain Co. is an equal opportunity employer. We make employment decisions without regard to race, color, religion, sex, national origin, age, disability, genetic information, or any other status protected by applicable federal, state, or local law. We provide reasonable accommodations for applicants and employees with disabilities or sincerely held religious beliefs - contact [e-mail] to request one.

Ready to build with us?