Senior Detection and Response Engineer

We Love AI Jobs; San Francisco (CA); On-site; USD 200,000 - 240,000; Full time

Job summary

Anyscale is seeking a Senior Detection and Response Engineer to own detection engineering and lead incident response across its cloud, endpoint, runtime, and corporate environments. This high-ownership role requires building the detection pipeline, response runbooks, and coordinating across teams to drive incidents to resolution.

You will own centralized correlation and alerting, tune detections for high signal, and run retrospectives to improve controls, reporting to the Head of Security.

Qualifications

• 6+ years in security with a focus on detection engineering and incident response.
• Hands-on experience building detections and correlation across cloud (AWS, Azure), endpoint (EDR), and runtime telemetry.
• Experience owning incident response end to end and leading during live incidents.

Responsibilities

• Own and build detection coverage across cloud, endpoint, and runtime telemetry.
• Own a centralized correlation and alerting capability that turns telemetry into detections.
• Own incident response runbooks, escalation paths, and coordination during incidents across corporate and production environments.

Skills

AWS

Azure

Kubernetes

EDR

SIEM

runtime security

detection engineering

incident response

Job description

# Senior Detection and Response EngineerAnyscaleSan FranciscoFull-time$200,000 – $240,000 / yearUpload your resume once and Scout applies for youApply with ScoutShare this job:LinkedInXSave imageYou’ll build Anyscale’s security detection capabilities and lead incident response across its cloud, endpoint, runtime, and corporate environments. The role owns alerting pipelines and response runbooks, and works with engineering and IT to investigate incidents and address gaps.* Permanent* On-site* 6+ years### Skills and expertiseAWSAzureKubernetesendpoint detection and response (EDR)SIEMruntime securitydetection engineeringincident response### Key responsibilities* Build detection coverage across cloud, endpoint, and runtime telemetry.* Own correlation, alerting, incident-response runbooks, and live incident coordination.* Tune detections, measure response performance, and use retrospectives to improve controls.## How this job comparesCompared with 167 open senior security jobs on October 10, 2026.Pay: This job pays $200K to $240K a year. The 75 open senior security jobs that publish US pay start at $171K on average, so this job starts about 17% higher.Similar open jobs: We Love AI Jobs lists 167 open senior security jobs at 85 companies.Remote work: This job is on site. 42 of the 167 senior security jobs (25%) are remote.AI in this role: Low. The company works with AI, but AI is a small part of this role's daily work. This is a security role focused on detection engineering and incident response across corporate and production environments. The posting does not describe regular work with AI models, tools, or products.## Full descriptionAt Anyscale, we're on a mission to democratize distributed computing and make it accessible to software developers of all skill levels. We’re commercializing Ray, a popular open-source project that's creating an ecosystem of libraries for scalable machine learning. Companies like OpenAI, Uber, Spotify, Instacart, Cruise, and many more, have Ray in their tech stacks to accelerate the progress of AI applications out into the real world.With Anyscale, we’re building the best place to run Ray, so that any developer or data scientist can scale an ML application from their laptop to the cluster without needing to be a distributed systems expert.Proud to be backed by Andreessen Horowitz, NEA, and Addition with $250+ million raised to date.About the RoleAnyscale's need to detect and respond to security events across its production and corporate environments is growing as the company scales. We're looking for a Senior Detection and Response Engineer to own detection engineering and to lead incident response when it counts, coordinating the response and driving it to resolution.This is a high-ownership role with real room to shape how detection and response works at Anyscale. You will own the detection pipeline, the response runbooks, and incident response, reporting to the Head of Security and partnering with engineering. This role is based in India.In your first year, success looks like strong detection coverage across our cloud, endpoint, and runtime telemetry, a working correlation and alerting pipeline, and incident response runbooks that have been exercised in practice.What You'll Do• Own and build detection coverage across cloud, endpoint, and runtime telemetry.• Own a centralized correlation and alerting capability that turns telemetry into actionable detections.• Own incident response: runbooks, escalation paths, and coordination during an incident, across corporate and production environments.• Drive detection of anomalous activity across the environments we run, including our Kubernetes footprint.• Tune detections to keep signal high and noise low, and measure detection and response performance such as mean time to detect and respond.• Run incident retrospectives and feed lessons back into detections and controls.• Partner with infrastructure security and IT to close gaps surfaced during response.What You'll Bring• 6+ years in security, with a strong focus on detection engineering and incident response, ideally at a high-growth startup.• Hands-on experience building detections and correlation across cloud (AWS, Azure), endpoint (EDR), and ideally container and runtime telemetry.• Experience owning incident response end to end, including leading during live incidents.• Comfort building and scaling a detection and response capability, not only operating an existing one.• Sound judgment under pressure and clear communication during incidents.• Fluency working with engineers and IT to close the gaps that response surfaces.Nice to Have• Experience with SIEM or detection platforms and detection-as-code approaches.• Familiarity with runtime security tooling such as Upwind or similar.• Threat hunting or purple-team experience.• Background in AI or ML platforms or distributed systems.Why Anyscale• We're on a mission to make scalable computing effortless. Ray is the AI Compute Engine at the center of some of the world's most powerful AI platforms• Our tech is in production at companies like OpenAI, Uber, Spotify, Instacart, and Cruise• We're backed by Andreessen Horowitz, NEA, and Addition, with $250M+ raised to date• Recent partnerships with Azure, CoreWeave, and Google Cloud are putting AI-native compute directly into enterprise environments