Senior Security Engineer, Detection & Response

Aircall; San Francisco (CA); On-site; USD 180,000 - 220,000; Full time

Benefits offered by this job

Competitive salary & benefits

Job summary

Aircall is seeking a Senior Security Engineer, Detection and Response to build and scale Aircall's threat detection and response capabilities. You will own detections from scratch, drive investigations, and mature the detection program across AWS accounts.

Expect heavy Python and Terraform development, with collaboration across security, product, and infrastructure teams. Two-thirds of the work is software/platform engineering; one-third is investigation, incident response, and threat hunting.

Qualifications

• 5+ years of hands-on experience in security operations, detection engineering, incident response, threat hunting, or similar fields.
• Production-grade Python and Terraform; capable of building detections and logging pipelines in production.
• Deep knowledge of adversarial tactics, techniques, and procedures (ATT&CK).
• Experience with SIEM/log analytics platforms and data lake tech (OpenSearch/Elasticsearch, Datadog, etc.).
• Cloud-first experience across AWS/Azure/GCP; owns security infra in production.
• Experience responding to incidents in production environments and conducting post-incident reviews.

Responsibilities

• Lead end-to-end development of detection logic from threat modeling to deployment across logs and cloud sources.
• Own the security data platform end to end, including SIEM ingestion pipelines and cost envelope.
• Write production Python and Terraform code for detections and automation weekly.
• Lead incident response, containment, remediation, and root cause analysis; drive post-incident reviews.
• Collaborate with Engineering, Product, Fraud, Privacy and Legal to improve detections and protections.
• Stay current on attacker techniques (MITRE ATT&CK, threat intel) and propose new detection patterns.

Skills

Threat hunting

Incident response

Security operations

Python programming

Terraform

Cloud security (AWS/Azure/GCP)

Communication skills

Tools

Terraform

OpenSearch

Elasticsearch

Datadog

AWS

Azure

GCP

Job description

Aircall is a unicorn, AI-powered customer communications platform used by 22,000+ companies worldwide to drive revenue, resolve issues faster, and scale customer-facing teams. We’re redefining customer communications by bringing voice, SMS, WhatsApp, and AI together into one seamless workspace.

Our momentum comes from a simple idea: help teams work smarter, not harder. Aircall’s AI Voice Agent automates routine calls, AI Assist streamlines post-call work, and AI Assist Pro delivers real-time guidance so people can do their best work. The result is higher revenue, faster resolutions, and teams that scale with confidence.

Aircall is headquartered in Paris, our European HQ, with a strong North American presence anchored in Seattle, our North American HQ, and teams across Madrid, London, Berlin, San Francisco, New York City, Sydney, and Mexico City. We’ve built a product customers love and a business that’s scaling quickly, backed by world-class investors and driven by rapid AI innovation across multiple product lines.

At Aircall, you’ll join a company in motion. We’re ambitious, product-driven, and execution-focused, with visible impact, fast decisions, and real growth.

How we work at Aircall

We’re customer-obsessed, data-driven, and focused on delivering meaningful outcomes. We value ownership, continuous learning, and thoughtful speed. If you thrive in a collaborative, fast-moving environment where trust and impact matter, you’ll feel at home here.

About The Role

As a Senior Security Engineer, Detection and Response you will develop, scale, and evolve Aircall's threat detection and response capabilities. You will take ownership of building detections from scratch, leading investigations, and driving the maturity of our detection program.

This is an owner-operator role. You will not be solely responding to alerts or consuming a detection platform that someone else runs, you will build and run it: the ingestion pipelines, the Terraform that defines them across sandbox, staging and production AWS accounts, the retention and cost posture, and the automation layered on top. Roughly two-thirds of the work is software and platform engineering; the remaining third is investigation, incident response and threat hunting. Expect to write production Python and Terraform every week, working alongside a product security, cloud and infrastructure security team you will partner with closely.

Our team builds the best solutions to our biggest problems, over the past year we've built our own AI SOC & IR agent, and we're applying those lessons to how we protect customer-facing AI products.

Responsibilities

• Leading direction and strategy of the DART program at Aircall
• Lead end-to-end development of detection logic: from threat modeling and hypothesis to writing, testing, simulation, tuning, and deploying detection rules and alerts across logs, telemetry, host, network, and cloud.
• Own the security data platform end to end. Operate and extend the SIEM and its ingestion pipelines, parsers, enrichment and normalization, defined as infrastructure-as-code and promoted from sandbox to production. Own its cost and capacity envelope and make the retention-versus-spend calls.
• Experiment and build unique tools at the front of the security space that solve significant security challenges.
• Expand and ship new security AI- and agent-based tooling for alert triage, investigation and detection building, including its authorization model, guardrails, evaluation harness and tracing.
• Conduct threat hunts proactively in company wide and production environments, discovering anomalies and attacker behaviors before they escalated.
• Lead incident response: investigate, contain, remediate, and perform root cause analysis. Drive post-incident reviews and feed lessons learned back into detection strategy.
• Assess security around new product features, including AI- and LLM-backed services and opportunities for detections or protections
• Author and maintain detection documentation, runbooks, alert definitions, tuning guidelines, and metrics.
• Collaborate cross-functionally with Engineering, Product, Fraud, Privacy and Legal
• Participate in on-call and threat-response rotations; elevate, coordinate, and remove blockers during high-severity events.
• Stay current on attacker techniques (MITRE ATT&CK, red team reports, threat intel) and propose new detection patterns or responses accordingly.
• Participate in hiring and interview evaluation of Security and Infrastructure engineering candidates, and in team growth.

Should have

• 5+ years of hands-on experience in security operations, detection engineering, incident response, threat hunting, or similar fields, or an equivalent combination.
• Production-grade Python and Terraform. A meaningful majority of this role's output is building detections managed in code, logging pipelines and custom security tools to scale sec ops. You should be able to point to services or Lambdas you built and Terraform modules you own and have maintained in production.
• Deep knowledge of adversarial tactics, techniques, and procedures, threat actor behavior, ATT&CK framework.
• Proven experience building detections from scratch rather than only tuning commercial alerts into a production-quality detection with a low false positive rate.
• Hands-on experience with SIEM or log analytics platforms and data lake technologies (OpenSearch, Elasticsearch, Clickhouse, Sentinel, Splunk, Datadog, AWS Athena, Azure synapse, Databricks or equivalent) and alerting/monitoring tooling.
• Cloud-first Azure, GCP, AWS experience. Beyond instrumenting detections across cloud workloads, this role provisions and owns production security infrastructure in AWS: VPCs, IAM, networking, private service endpoints.
• Experience in digital forensics, host-based detection, endpoint telemetry, process and network visibility, and cloud observability.
• Experience responding to incidents in production environments: investigating logs, building timelines, establishing root cause, and containing.
• Familiarity with security automation and orchestration, playbooks, response automation, and alert triage workflows.
• Comfort as the primary owner of a domain. You will lead detection and response engineering, set your own priorities and move confidently where documentation is thin or stale.
• Strong communication skills; the ability to translate complex detection logic, trade-offs and risk to engineers and to leadership.
• A high degree of autonomy, initiative, and ownership, with the ability to drive entire initiatives with minimal oversight.

Bonus / Nice-to-have

• Experience building on or securing LLM and agent systems — Azure foundry, Bedrock/AgentCore, LangGraph, guardrails, policy-based authorization, prompt-injection defense, and agent evaluation.
• Purple/Red team, App Sec or Production security experience. To develop proof of concepts against systems and simulate attacks, test controls and protections effectiveness. This position is not a full time red team position.
• Vulnerability management program ownership (Wiz or comparable CSPM, bug bounty triage, SLA enforcement).
• Fraud and abuse investigation in a multi-tenant SaaS product — account takeover, credential stuffing, trial and promo abuse, toll fraud.
• Open source detection tooling contributions or public speaking at security conferences

Base salary range:: $180,000 USD - $220,000 USD

Why join us?

• Key moment to join Aircall in terms of growth and opportunities
• Our people matter, work-life balance is important at Aircall
• Fast-learning environment, entrepreneurial and strong team spirit
• 45+ Nationalities: cosmopolite & multi-cultural mindset
• Competitive salary package & benefits

DE&I Statement

At Aircall, we believe diversity, equity and inclusion – irrespective of origins, identity, background and orientations – are core to our journey. We pride ourselves on promoting active inclusion within our business to foster a strong sense of belonging for all. We’re working to create a place filled with diverse people who can enrich and learn from one another. We’re committed to ensuring that everyone not only has a seat at the table but is valued and respected at it by providing equal opportunities to develop and thrive. We will constantly challenge ourselves to make sure that we live up to our ambitions around diversity, equity and inclusion, and keep this conversation open. Above all else, we understand and acknowledge that we have work to do and much to learn.

Want to know more about candidate privacy? Find our Candidate Privacy Notice here.