Senior Security Engineer: AI-Driven Detection & Response

Aircall; Seattle (WA); On-site; USD 180,000 - 220,000; Full time

Benefits offered by this job

Competitive salary package

Job summary

Aircall seeks a Senior Security Engineer, Detection and Response, to design and scale threat detection across logs, hosts, networks, and cloud. You will own the data platform, write production Python and Terraform, and drive end-to-end detection from hypothesis to deployment with a cross-functional team.

This owner-operator role requires automation, cloud security expertise, and the ability to translate complex risks for engineers and leadership.

Qualifications

• 5+ years hands-on experience in security operations, detection engineering, incident response, threat hunting, or similar fields.
• Production-grade Python and Terraform. A meaningful majority of this role's output is building detections managed in code, logging pipelines and custom security tools to scale sec ops.
• Deep knowledge of adversarial tactics, techniques, and procedures, threat actor behavior, ATT&CK framework.
• Experience building detections from scratch and owning production security tooling.

Responsibilities

• Lead direction and strategy of the DART program at Aircall.
• Lead end-to-end development of detection logic: threat modeling to deployment across logs, telemetry, host, network, and cloud.
• Own the security data platform end to end. Manage SIEM ingestion pipelines, parsers, enrichment and normalization as code; control cost and retention.
• Experiment and build unique tools at the front of the security space to solve detection challenges.
• Expand and ship security AI- and agent-based tooling for alert triage, investigation, and detection building.

Skills

Security operations

Incident response

Threat hunting

Detection engineering

Python

Terraform

Tools

OpenSearch

Elasticsearch

Datadog

Splunk

AWS Athena

Job description

Aircall seeks a Senior Security Engineer, Detection and Response, to design and scale threat detection across logs, hosts, networks, and cloud. You will own the data platform, write production Python and Terraform, and drive end-to-end detection from hypothesis to deployment with a cross-functional team.

This owner-operator role requires automation, cloud security expertise, and the ability to translate complex risks for engineers and leadership.