Senior Security Detection & Incident Response Engineer

LiteLLM; San Francisco (CA); On-site; USD 150,000 - 210,000; Full time

Job summary

LiteLLM in San Francisco is seeking a Senior Security Operations / Detection Engineer to build and own detection and response across our infrastructure. You’ll own log pipelines, detections, runbooks, alert handling, and incident coordination with a small, fast-moving team.

This hands-on role reports to security lead, requires 5+ years, experience building detection from scratch, SIEM tuning (Splunk), and strong Python scripting.

Qualifications

• 5+ years of relevant experience.
• Experience building a detection and response function from scratch.
• Hands-on experience building and tuning SIEM detections, preferably in Splunk, and managing them as code.
• Experience building log pipelines from cloud and CI systems.
• Strong familiarity with GitHub, Okta, and cloud audit logs.

Responsibilities

• Build and maintain security log pipelines and document coverage gaps.
• Build, validate, and tune detections across cloud infrastructure, CI systems, identity providers, and internal services.
• Manage detections as code, with clear documentation and ongoing maintenance.
• Write and maintain a runbook for every alert.
• Define severity-based alert response SLAs and own performance against them.
• Lead incidents from investigation and containment through recovery and follow-up.
• Produce clear incident timelines, reports, and recommendations.
• Measure and improve time to detect and contain threats.
• Automate detection of unexpected identity and access changes and drive remediation.
• Prioritize improvements based on risk and the needs of a small engineering organization.

Skills

SIEM (Splunk)

Detection engineering

Incident response

Python scripting

Cloud logs

Tools

GitHub

Okta

Splunk

Job description

LiteLLM in San Francisco is seeking a Senior Security Operations / Detection Engineer to build and own detection and response across our infrastructure. You’ll own log pipelines, detections, runbooks, alert handling, and incident coordination with a small, fast-moving team.

This hands-on role reports to security lead, requires 5+ years, experience building detection from scratch, SIEM tuning (Splunk), and strong Python scripting.