Staff Security Engineer, AI-Driven Detection & Response

Remote; San Francisco (CA); Hybrid; USD 180.000 - 260.000; Vollzeit

Benefits dieser Stelle

Generous PTO

RRSP match

Flexible benefits package

Training budget

Product discounts

Work Wherever You Work Well

Zusammenfassung

Fullscript is seeking a Staff Security Engineer to define and drive defensive threat detection and AI-assisted SecOps across cloud infrastructure, identity, endpoints, and applications. You will architect modern detection systems, leverage AI/ML to automate workflows, and scale defenses for a fast-growing AI-first platform.

The ideal candidate has owned enterprise-scale detection engineering and end-to-end incident response, with hands-on experience in AI threat vectors, SIEM, and security

Qualifikationen

• 8+ years of experience in detection engineering, incident response, or security engineering with leadership in security strategy.
• Experience weaving AI tooling into SecOps workflows and AI-threat vectors awareness.
• Strong scripting/automation skills (Python, JavaScript) and workflow automation experience.
• Experience managing security controls as code (Terraform) through peer reviews.
• Experience securing cloud environments (AWS) and modern SaaS/identity stacks.

Aufgaben

• Define detection and response direction across Security, Platform, and Engineering teams.
• Architect and maintain advanced detection logic across SIEM, cloud, identity, and AI/ML pipelines.
• Lead AI-augmented SecOps workflows and defensive testing for AI threats.
• Operate incident response end-to-end and mentor SOC team members.
• Maintain dashboards and metrics for leadership visibility on alerts and response times.
• Lead threat intelligence to actionable detections and IOC blocking.

Kenntnisse

Detection engineering

Incident response

Security engineering

Automation scripting

Terraform

AWS security

MITRE ATT&CK

Stakeholder communication

Tools

Python

JavaScript

SOAR platforms

Terraform

Jobbeschreibung

About FullscriptWe’re an industry-leading health technology company on a mission to help people get better. We started in 2011 with one simple idea. Make it easier for practitioners to access the products they trust so they can deliver better care.That simple idea grew into a platform that powers every part of care. Today, more than 125,000 practitioners use Fullscript for clinical insights, lab interpretations, patient analytics, education, and access to high-quality supplements. Over 10 million patients rely on Fullscript to stay connected to their care plans and follow through on treatment.We build tools that make care smarter and more human. Tools that save time, simplify decisions, and help practitioners stay closely connected to the people they care for. When everything they need is in one place, they can focus on what matters most: helping people get better.This is your invitation.Bring your ideas, your grit, and your care for people. Join us and shape the future of care.

The Opportunity

We're looking for a Staff Security Engineer to define and drive Fullscript's defensive threat detection, incident response, and AI-assisted SecOps capability across our cloud infrastructure, identity, endpoints, and application ecosystems.

This role sits at the technical core of our Security function. You will architect modern detection systems, leverage AI/ML to automate SecOps workflows, and establish defensive testing practices for AI threat vectors. Partnering with Engineering and Platform teams, you will ensure our detection and response capabilities scale with Fullscript's fast-growing, AI-first infrastructure.

The ideal candidate has owned enterprise-scale detection engineering and incident response end-to-end. You are a pragmatic, forward-thinking engineer who excels at designing AI-augmented SOC workflows, conducting targeted AI defensive testing, and converting threat telemetry into automated, high-precision detection and response systems.

What You'll Do

Detection Engineering & Defensive Strategy

• Set the multi-quarter technical direction for detection and response, and drive it across Security, Platform, and Engineering teams.

• Architect, author, and maintain advanced detection logic across SIEM, cloud infrastructure, identity systems, endpoint protection, and AI/ML pipelines.

• Establish detection coverage and defensive controls against emerging AI and agentic threat vectors (e.g., prompt injection, tool misuse, and data exfiltration patterns).

• Own the full rule lifecycle, from authoring and testing through tuning and retirement, and measure it against concrete signals: detection coverage, precision (false-positive rate), and time-to-detect.

• Create and maintain dashboards and reporting that give leadership visibility into alert volume, response times, and trends over time.

AI-Augmented Security Operations & Automation

• Design and deploy AI-assisted investigation workflows that leverage LLMs and automated agents to accelerate triage, context enrichment, and threat containment.

• Build and extend internal security tooling to support identity resolution, cross-source log correlation, and natural-language querying over security telemetry.

• Automate the handoff between detection tooling and our ticketing system so investigations move from alert to resolution with minimal manual work.

Incident Response & Investigations

• Lead and support security investigations end-to-end, from initial triage through containment and resolution.

• Mentor Security Operations team members and set the standards the team builds against, including rule quality, detection-as-code practices, and investigation rigor.

• Partner with relevant teams across the business to investigate and remediate security escalations surfaced from Customer Support, Customer Delivery, and internal teams.

• Maintain and improve response playbooks based on lessons learned from real investigations.

• Participate in an on-call rotation to respond to security incidents outside business hours.

AI Defensive Testing & Validation

• Threat model new and existing systems, including AI agents and services, to identify what could go wrong, what we would need to see to catch it, and how we would respond.

• Lead defensive testing, purple-teaming, and adversarial validation exercises to test alert fidelity and evaluate detection resilience against AI-driven threats.

• Partner with Platform and Engineering teams to ensure new AI services and features expose necessary logging and telemetry for effective security monitoring.

• Evaluate authorization and access-control changes for security-relevant blast radius, and drive remediation with the engineering teams that own the affected systems.

Threat Intelligence

• Operationalize threat intelligence into actionable detections and tracked follow-up work.

• Coordinate indicator of compromise (IOC) blocking across endpoint, network, and web layers.

What You Bring to the Table

• 8+ years of experience in detection engineering, incident response, or security engineering, with demonstrated leadership in shaping organizational security strategy.

• Practical experience incorporating AI tooling into SecOps workflows, along with familiarity with detection strategies for AI-specific threat vectors.

• Strong scripting/automation skills (Python, JavaScript, or similar) and experience building workflows in a SOAR-style or workflow automation platform.

• Experience managing security controls as code (e.g., Terraform), with changes made through peer review rather than manual console changes.

• Experience securing cloud environments (AWS preferred) and modern SaaS/identity stacks.

• Hands‑on incident response experience: triage, investigation, containment, and postmortem/playbook development.

• Working knowledge of adversary tradecraft (MITRE ATT&CK) and the ability to translate it into practical, tuned detections rather than noisy alerts.

• Proven ability to partner directly with engineering and infrastructure teams to define telemetry and control requirements for systems you don't own.

• Excellent written communication. This role regularly turns investigation findings into clear, factual updates for technical and non-technical stakeholders alike.

Bonus if You Have

• Experience contributing to or building from open detection content, such as Sigma rules or community rule repos.

• Experience collaborating with red/purple-team exercises to validate detection coverage.

• Experience supporting a healthcare, regulated, or otherwise highly sensitive-data environment.

• Relevant certifications (GCIH, GCFA, GCTI, GCDA, or equivalent practical experience).

What we can offer you:

• Generous PTO and competitive pay

• Fullscript’s RRSP match program for financial health

• Flexible benefits package and workplace wellness program

• Training budget and company-wide learning initiatives

• Discount on Fullscript catalog of products

• Ability to work Wherever You Work Well*

*Our Wherever You Work Well philosophy means Fullscript teammates get to pick their own office — whether that’s in-office, at home, or a bit of both

Why Fullscript Great work happens when people feel supported, trusted, and inspired. At Fullscript, we stay curious and keep finding smarter ways to make care better. We grow together, take on new challenges, and focus on impact. We put people first, work as a team, and leave egos at the door.