Staff Detection & Response Platform Engineer

Lovable; Town of Stockholm (NY); On-site; USD 180,000 - 320,000; Full time

Job summary

Lovable is building a detection and response capability that catches attackers before they matter—across corporate, production, and AI-agent surfaces. You’ll lead the creation of detections as code, automated triage, and 24/7 incident response oversight.

As a staff/principal leader, you will hunt across cloud telemetry (GCP/AWS/Cloudflare), EDR, identity logs, and modern data stacks, guiding real-time response and post-mortems.

Qualifications

• 8+ years in detection engineering, incident response, or threat hunting, with at least 3 at staff/principal level.
• Strong engineering background - you build detections as code, not as saved searches in a SIEM.
• Deep experience with cloud telemetry (GCP/AWS/Cloudflare), endpoint EDR, identity logs, and modern SIEM/data-lake stacks (Panther, Elastic, Snowflake/Clickhouse).
• Battle-tested incident commander who has led real high-severity incidents from first alert to public post-mortem.
• Adversary-minded: comfortable with MITRE ATT&CK, threat intel, purple-teaming, and red team collaboration.
• Bonus: detection for LLM/agent abuse, prompt injection at scale, or insider risk in AI-augmented engineering orgs.

Responsibilities

• Build the detection engineering platform - pipelines, detections-as-code, automated triage, and response playbooks.
• Design and own security incident response process with 24/7 coverage, with a small, high-leverage human and agent team.
• Lead incidents end-to-end: detection, containment, eradication, post-mortem, and follow-through.
• Hunt proactively across corporate, production, and AI-agent surfaces - and turn every finding into a durable detection.
• Define what 'world-class D&R for an AI-native company' looks like, and build it.

Skills

Detection engineering

Incident response

Threat hunting

Cloud telemetry

EDR

MITRE ATT&CK

Threat intel

Purple-teaming

Red team

Team leadership

Tools

Panther

Elastic

Snowflake

ClickHouse

Job description

Lovable is building a detection and response capability that catches attackers before they matter—across corporate, production, and AI-agent surfaces. You’ll lead the creation of detections as code, automated triage, and 24/7 incident response oversight.

As a staff/principal leader, you will hunt across cloud telemetry (GCP/AWS/Cloudflare), EDR, identity logs, and modern data stacks, guiding real-time response and post-mortems.