Staff Security Engineer, Detection & Response

Cybersecurity Jobs; San Francisco (CA); Hybrid; USD 221,000 - 299,000; Full time

Benefits offered by this job

Health insurance

Maven for Mavens platform access

Parental leave (16 weeks)

Job summary

Maven Clinic is seeking a Staff Security Engineer to lead Incident Detection and Response across the organization in a hybrid role based in San Francisco. You will guide investigations, strengthen SDLC controls, and develop detection engineering that scales as AI, LLMs, AI-generated code, and agents become more embedded in the codebase and internal workflows.

You will own the Incident Detection and Response program, including threat modeling, hands-on investigations, proactive hunting, and

Qualifications

• 6+ years security experience with hands-on software/AppSec and SIEM ownership.
• Ability to read production code across multiple languages to assess exploitability.
• Experience creating threat models for codebases and data flow.

Responsibilities

• Lead investigations by collecting logs, building narrative, advising stakeholders.
• Review production code to understand behavior.
• Conduct proactive hunting to identify weaknesses in SDLC and codebase.
• Propose and implement fixes or coordinate resolutions with teams.
• Collaborate to establish golden paths for systemic gaps.

Skills

Security engineering

Code reading

Threat modeling

Incident response

Communication

Education

GCIH

GCFA

GCDA

OSCP

CISSP

Tools

AI SOC platforms

LLMs

SIEM

Job description

Maven Clinic is looking for a Staff Security Engineer to lead Incident Detection and Response across the organization. In this hybrid role based in San Francisco, you will guide investigations, strengthen SDLC controls, and develop detection engineering that scales as AI, LLMs, AI-generated code, and agents become more embedded in the codebase and internal workflows.

Role Overview

You will own Maven Clinic’s Incident Detection and Response program, including threat modeling, hands‑on investigations, proactive hunting and hardening of the SDLC, and the creation and validation of detection engineering. You will also manage security risk as new AI-driven capabilities expand across systems and adoption grows internally.

Responsibilities

• Lead investigations hands‑on by pulling logs, constructing an incident narrative, and advising business and engineering leaders on next steps.
• Review production code when needed to understand what is actually occurring.
• Conduct proactive hunting to identify bugs in the codebase and weaknesses in the SDLC where issues can bypass existing controls.
• Propose and implement fixes directly, or coordinate resolution with the appropriate teams, including code fixes and broader process or control changes.
• Collaborate with the Product Security Engineer to establish golden paths when a weakness indicates a systemic gap.
• Own and tune detection logic running through 7AI, validating investigations and escalations, and defining alert-trigger criteria.
• Identify and remediate gaps in logging and visibility so security tooling has the data required to operate effectively.
• Support risk management for the organization’s expanding use of LLMs and AI tooling, covering both what is built and what is adopted internally.

Requirements

• 6+ years of security experience combining hands‑on software or AppSec depth with detection and SIEM engineering ownership.
• Ability to read production code across multiple languages and stacks well enough to assess whether a finding is exploitable.
• Experience creating threat models for codebases, including attack surface, trust boundaries, and data flow to anticipate where issues will emerge.
• A demonstrated track record of identifying and remediating systemic weaknesses, whether discovered through incidents or proactive review.
• Strong communication skills with credibility to direct an investigation and influence peers informally.

Preferred Qualifications

• Hands‑on experience with AI-assisted security operations tooling, such as AI SOC platforms, LLM‑based triage, or agentic escalation systems.
• Interest or experience securing AI and LLM‑powered systems, including risks such as prompt injection, model misuse, and agentic tool abuse.
• Exposure to golden-path or secure‑by‑default infrastructure initiatives, even in a supporting capacity.
• Experience with container or image security and the patching lifecycle.
• A relevant certification such as GCIH, GCFA, GCDA, OSCP, or CISSP.

Technologies

• 7AI
• LLMs
• SIEM

Compensation

The base salary range for this role is USD 221,000 - 299,000 per year. You will also be entitled to receive equity and benefits.

Benefits

• Employer-covered health, dental, and insurance plan options
• Maven for Mavens: access to the full platform and specialists, including care for mental health, reproductive health, family planning, and pediatrics
• Whole-self care through wellness partnerships
• Hybrid work, in‑office meals, and work together days
• 16 weeks 100% paid parental leave and new parent stipend (for Mavens who have been with us for 1 year+)
• Annual professional development stipend and access to a personal career coach through Maven for Mavens
• 401K matching for US‑based employees, with immediate vesting

Work Model and Location

Maven embraces a flexible hybrid work model. Teams primarily operate from the New York Metropolitan area, NY, and remotely via San Francisco/Bay Area, CA, Seattle, WA.

• For those in the New York City office: in‑person collaboration is encouraged by requiring team members to work onsite three days per week (Tuesday, Wednesday, Thursday).
• For those based in Boston, DC, Chicago, Seattle, and San Francisco: in‑person collaboration is encouraged by requiring team members to attend monthly Work Together Days within these cities.