Senior Detection & Response Engineer — Incident Ops Lead

Serval Inc.; San Francisco (CA); On-site; USD 180,000 - 300,000; Full time

Benefits offered by this job

Impact

Growth

Culture

Job summary

Serval Inc. is seeking a Detection and Response Lead to shape and scale cybersecurity operations across its infrastructure and customer environments.

You will set strategy, drive execution, and mentor a team responsible for monitoring, incident response, recovery, and post-incident improvements. You will lead a hands-on security function, partner with Engineering and Product, and ensure detection and response are embedded by design into Serval’s systems.

Qualifications

• 10+ years in cybersecurity with deep expertise in detection engineering, incident response, and security operations.
• Experience building and leading detection and response, instrumentation/observability, and threat intelligence teams.
• Strong leadership skills with a track record of durable, continuous improvements to programs, processes and people.
• Exceptional written and verbal communication skills, calm under pressure, able to lead security incidents with many stakeholders.
• Deep expertise in modern observability stacks (SIEM, data lakes, EDR, cloud telemetry, logging).
• Understanding adversary tradecraft (TTPs) and translating it into practical detection strategies and response actions.
• Mission-oriented, unimpeachable integrity, thrives in a fast-paced, complex environment.

Responsibilities

• Design, implement, and operate detection and response across networks and infrastructure.
• Lead and mentor a team spanning observability, detection, response, and threat intelligence.
• Maintain incident playbooks, on-call rotations, escalations, and tabletop exercises.
• Improve detection quality and coverage with engineering partnerships for telemetry.
• Embed detection and response into Serval's systems by design, not as an afterthought.
• Build a security program capable of withstanding sophisticated adversaries.

Skills

Cybersecurity

Detection engineering

Incident response

Security operations

Leadership

Communication

Tools

SIEM

EDR

Data lakes

Logging

Job description

Serval Inc. is seeking a Detection and Response Lead to shape and scale cybersecurity operations across its infrastructure and customer environments.

You will set strategy, drive execution, and mentor a team responsible for monitoring, incident response, recovery, and post-incident improvements. You will lead a hands-on security function, partner with Engineering and Product, and ensure detection and response are embedded by design into Serval’s systems.