Senior Detection & Response Engineer: Incident Lead

Carbon Data Solutions; San Francisco (CA); Remote; USD 150,000 - 230,000; Full time

Job summary

Anyscale is seeking a Senior Detection and Response Engineer to own detection engineering and lead incident response across production and corporate environments. You will own the detection pipeline, runbooks, and incident response, reporting to the Head of Security and partnering with engineering.

This role is based in India and offers global impact. In your first year, you will grow coverage across cloud, endpoint, and runtime telemetry, build a centralized correlation/alerting pipeline, and

Qualifications

• 6+ years in security with focus on detection engineering and incident response.
• Experience building detections across cloud, endpoint, and runtime telemetry.
• Experience leading incident response end-to-end during live incidents.

Responsibilities

• Own detection coverage across cloud, endpoint, and runtime telemetry.
• Own centralized correlation and alerting to produce detections.
• Own incident response runbooks and escalation during incidents.
• Drive detection of anomalous activity including Kubernetes footprint.
• Tune detections to maximize signal and minimize noise; measure MTTD/MTTR.
• Run incident retrospectives and feed lessons back into detections.
• Partner with infrastructure security and IT to close gaps.

Skills

Detection engineering

Incident response

Cloud security (AWS/Azure)

Endpoint security (EDR)

Container/runtime telemetry

Communication under pressure

Engineering collaboration

Tools

SIEM

Detection platforms

Upwind

Job description

Anyscale is seeking a Senior Detection and Response Engineer to own detection engineering and lead incident response across production and corporate environments. You will own the detection pipeline, runbooks, and incident response, reporting to the Head of Security and partnering with engineering.

This role is based in India and offers global impact. In your first year, you will grow coverage across cloud, endpoint, and runtime telemetry, build a centralized correlation/alerting pipeline, and