Senior/Staff Threat Detection & Response Engineer

Legora; New York (NY); On-site; USD 170,000 - 210,000; Full time

Benefits offered by this job

In-person Union Square office

Comprehensive salary and benefits

401(k) with company match

Unlimited PTO

Company-funded lunch daily

Medical, Dental & Vision

Job summary

Legora, an AI-native security leader, is seeking a senior security engineer in New York City to own detection and response across endpoints, identity, cloud workloads, SaaS, and AI systems. You will hunt, triage, investigate, contain, and drive incidents through resolution with production-grade detections.

You will implement telemetry pipelines, build threat models, and map coverage to MITRE ATT&CK. Collaboration with on-call teams and cross-functional partners is essential to strengthen

Qualifications

• 5+ years in detection engineering, IR, or security operations, including senior escalation experience.
• Strong software skills in Python and SQL for production telemetry and automation.
• Experience using LLMs and agents in security workflows and incident investigations.

Responsibilities

• Own detection and response across endpoints, identity, cloud workloads, SaaS, and Legora's AI systems.
• Build detections as production software with telemetry and CI/CD, and measure coverage and time to detection.
• Develop threat models, telemetry, and response playbooks for AI systems and agents.
• Map coverage to MITRE ATT&CK and validate through threat hunting and pen-testing findings.
• Share on-call rotation and act as incident commander during security incidents.
• Lead post-incident reviews and translate findings into improved detections and controls.

Skills

Python

SQL

Detection engineering

Incident response

Security operations

LLMs & automation

Communication

Tools

SIEM

Security data lake

KQL/SPL/Sigma

Job description

Legora, an AI-native security leader, is seeking a senior security engineer in New York City to own detection and response across endpoints, identity, cloud workloads, SaaS, and AI systems. You will hunt, triage, investigate, contain, and drive incidents through resolution with production-grade detections.

You will implement telemetry pipelines, build threat models, and map coverage to MITRE ATT&CK. Collaboration with on-call teams and cross-functional partners is essential to strengthen