Senior Security Engineer, Detection & Response

Angi; United States; Remote; USD 150,000 - 225,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

Flexible vacation policy

Equity package

401(k) retirement plan

Pet discount plans

Job summary

Angi is seeking a senior security engineer to own detections across AWS, EDR, and identity platforms, with a strong focus on observability and incident response. You will build and maintain a log pipeline, apply AI-assisted security approaches, and drive compliance controls such as PCI DSS.

You will work remotely from the US, aligned with eastern or central time zones to coordinate with the team, and participate in a 24/7 on-call rotation to protect a global home-services platform.

Qualifications

• 5+ years in a security role supporting product/engineering, cloud infra, and corporate infra
• Proficient in Python and building reliable security infrastructure with CI/CD
• Strong analytics and observability experience with Grafana/Looker/New Relic
• Hands-on AWS and infrastructure-as-code (Terraform/CloudFormation)
• Experience with EDR, SIEM, and SOAR platforms and their APIs
• Hands-on with containers and Kubernetes for security/forensics
• Balanced build-vs-buy judgment, capable of extending or replacing tooling
• Experience owning incidents end-to-end from paging to postmortem
• Exposure to LLM/agentic security concepts including prompt injection and exfiltration
• Strong written communication to document detections, postmortems, and design feedback
• Comfort with PCI/SOX-like compliance aspects is a plus

Responsibilities

• Build and own detections across AWS services, EDR, identity, SaaS, and AI gateway
• Own security log pipeline as a product with centralized, consumable logs
• Detect on application protection layer: account takeover, credential stuffing, abuse patterns
• Develop triage layer: enrichment, correlation, containment, evidence capture with trustworthy outputs
• Ship code in a repo; extend or replace tools where needed
• Extend coverage to agentic AI products: prompt injections and data exfiltration
• Participate in 24/7 on-call rotation for incident response
• Maintain controls for PCI DSS: tamper-detection, log integrity, alert coverage
• Collaborate with platform/product teams to embed telemetry, threat models, and playbooks

Skills

Security engineering

Python

CI/CD

AWS

Terraform

Kubernetes

Observability

Incident response

Communication

Tools

Grafana

Looker

New Relic

Terraform

Job description

For over 30 years, Angi has powered the future of the home services industry, creating an environment where homeowners and pros benefit from more jobs done well.

For homeowners, our platform is a reliable way to find skilled pros. For pros, we're a reliable business partner who helps them find the winnable work they want, when they want. For employees, we're an amazing place to call home. We can't wait to welcome you.

Angi at a glance:

• Founded in 1995 as Angie’s List and rebranded in 2021

• Global company with 9 brands in 8 countries and employees worldwide

• Homeowners have turned to us for 300 million home projects and counting

About the team:

At Angi, security is woven into everything we build, from PCI-scoped payment flows to the AI agents now handling homeowner/pro conversations and scheduling end-to-end. Detection signal spans cloud, endpoint, identity, SaaS, and a growing set of autonomous agents. You'll own detection and response as an engineering problem: build the detections, build the automation that works them, and carry the pager for what still gets through.

While this is a remote position, we are a global company and are looking for applicants located in eastern or central time zones to align with our team's working hours.

What you’ll do:

• Build and own detections across AWS (GuardDuty, CloudTrail, SecurityHub), EDR, identity, SaaS, and our AI gateway. Coverage, precision, and latency are properties we manage across a rule's lifecycle.

• Own the security log pipeline, and own it as a product with consumers: audit and security logs land centrally and are exposed to the teams that need them for triage, analysis, and incident response.

• Own detection on the application protection layer - account takeover, credential stuffing, and abuse patterns against a two-sided marketplace.

• Build the triage layer - enrichment, correlation, containment, evidence capture - working toward a median alert that resolves without a human touching it. Use LLM and agentic tooling where it earns its place, and own the verification layer that makes that output trustworthy.

• Buy the tool where a tool is right, build where it isn't, and extend where it's close. You'll ship code in a repo, not only configure consoles.

• Extend detection coverage to Angi's agentic AI products: what anomalous behavior looks like for an autonomous agent holding calendar and account access - prompt injection attempts, tool-call abuse, data exfiltration through the agent surface.

• Actively participate in all facets of the incident response lifecycle by participating in a 24/7 on-call rotation.

• Own the technical controls InfoSec retains for detection within compliance frameworks such as PCI DSS (tamper-detection monitoring, log integrity, alerting coverage).

• Partner with platform and product teams so new services ship with telemetry, threat models, and response playbooks. You will be in the room when these are designed, not brought in after the fact.

Who you are:

• You have 5+ years of experience working on a security team supporting product/engineering functions, cloud infrastructure, and corporate infrastructure development

• You have software engineering experience (Python preferred) and an engineering mindset for building reliable / maintainable security infrastructure to support a large organization with CI/CD software engineering practices

• You are at home in the analytics and observability stack detections get measured on - Grafana, Looker, NewRelic or similar. You will build your own coverage and precision dashboards rather than filing a ticket for them.

• Hands-on with AWS and infrastructure-as-code (Terraform, CloudFormation, or equivalent); working knowledge of EDR, SIEM, and SOAR platforms and their APIs.

• Hands-on with containers and Kubernetes, including what detection and forensics look like on that surface.

• Sound build-versus-buy judgment with no allergy to either answer. You reach for what exists when it fits, and you're comfortable wrapping, extending, or replacing it when it doesn't.

• You've owned incidents end to end - page, diagnosis, fix, postmortem.

• Some level of exposure to LLM/agentic system security (prompt injection, agent identity, data exfiltration via AI systems).

• A daily, fluent user of AI-assisted coding/security tools. You are able to speak concretely about how you direct and verify AI output.

• Strong written communication: you'll write detection documentation, postmortems, and design feedback that other engineers rely on.

• Comfort executing the technical side of a compliance framework (PCI, SOX, or similar) is preferred.

Compensation & Benefits

• The base salary band for this position ranges from $150,000 - $225,000, commensurate with experience and performance. Compensation may vary based on factors such as geographic location.

• This position will be eligible for a competitive year end performance bonus & equity package.

• Full medical, dental, vision package to fit your needs.

• Flexible vacation policy; work hard and take time when you need it.

• Pet discount plans & retirement plan with company match (401K).

• The rare opportunity to work with sharp, motivated teammates solving some of the most unique challenges and changing the world.

We value diversity

We know that the best ideas come from teams where diverse points of view uncover new solutions to hard problems. We welcome and value individuals who bring diverse life experiences, educational backgrounds, cultures, and work experiences.

Our hiring process may utilize artificial intelligence (AI) tools to assist in candidate screening and assessment. Our AI tools are designed to complement, not replace, human decision-making.

#LI-Remote