Senior Detection & Response Engineer — On-Site NYC

Legora; New York (NY); On-site; USD 180,000 - 235,000; Full time

Benefits offered by this job

Union Square office

Lunch daily

Competitive benefits

401(k) with match

Unlimited PTO

Job summary

Legora in Manhattan, NYC is seeking a senior security operations professional to own detection and response across endpoints, identity, cloud workloads, and AI systems. You will hunt, triage, investigate, contain, and drive incidents to resolution, then turn findings into improved detections and controls.

The role requires building detections as production software, maintaining CI/CD pipelines, and mapping coverage to MITRE ATT&CK.

Qualifications

• 5+ years in detection engineering, incident response, or security operations, including senior escalation experience.
• Strong Python and SQL skills; you build production-grade detections and telemetry pipelines.
• Experience using LLMs and agents; able to justify human-in-the-loop decisions.
• Fluent across endpoint, identity, cloud, and SaaS telemetry; correlates signals across systems.
• Clear incident communication; post-incident reviews lead to concrete changes.

Responsibilities

• Own detection and response across endpoints, identity, cloud workloads, SaaS, and AI systems; hunt, triage, investigate, contain, and drive incidents to resolution.
• Build detections as production software; maintain version control, testing, and CI/CD deployment; measure coverage and time to detection.
• Develop threat models, telemetry, and response playbooks for AI systems and agents; detect misuse of agents.
• Build and supervise agents for triage, enrichment, and investigation; set guardrails and approval thresholds.
• Map coverage to MITRE ATT&CK; validate through threat hunting, pentests, and adversary emulation.
• Share on-call rotation and act as incident commander; coordinate communications and post-incident reviews to reduce time.
• Investigate insider risk and identity abuse; coordinate with Vulnerability Management and IT Systems.
• Track campaigns targeting AI companies; manage the digital-risk platform and takedown phishing/impersonation threats.

Skills

Python

SQL

Detection engineering

Incident response

Security operations

LLMs & agents

Tools

SIEM

Security data lake

SPL

KQL

YARA-L

Sigma

Job description

Legora in Manhattan, NYC is seeking a senior security operations professional to own detection and response across endpoints, identity, cloud workloads, and AI systems. You will hunt, triage, investigate, contain, and drive incidents to resolution, then turn findings into improved detections and controls.

The role requires building detections as production software, maintaining CI/CD pipelines, and mapping coverage to MITRE ATT&CK.