Threat Detection & Incident Response Engineer

Speedrun Talent Network; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

Daily lunch, snacks, and beverages

Flexible time off

Competitive salary and equity

Job summary

Braintrust is seeking a Detection and Response engineer to design and build security systems that identify threats across the Braintrust stack. You will run detection-as-code, lead incident response, and stay ahead with real-time threat intelligence.

You will work with Python/TypeScript/Go, AWS, Kubernetes, and cloud endpoints; build telemetry pipelines; investigate incidents; write postmortems; and contribute to AI/LLM security controls.

Qualifications

• Experience designing and operating detection and response systems.
• Hands-on incident handling and postmortems.
• Experience with cloud platforms (AWS, Azure or GCP) and Kubernetes.

Responsibilities

• Build security telemetry pipelines across cloud execution environments (ECS/K8s), CI/CD systems, identity systems, endpoints, and agentic workloads.
• Continuously improve detections for attacks, abuse, and anomalous behavior.
• Own the alert pipeline end-to-end and keep signal-to-noise high.
• Lead incident response and participate in on-call: triage, scope, contain, and remediate incidents, then write postmortems that produce durable improvements.
• Hunt proactively for threats and build tooling for turning evidence into new detections.
• Build agents that triage alerts, enrich findings, gather evidence, and scope incidents with human-in-the-loop controls.
• Run vulnerability response, evaluating impact and driving remediation across our infrastructure.
• Proficient in modern backend technologies and comfortable writing real code in Python, TypeScript, or Go.
• AWS experience and working fluency in at least one of Azure or GCP.
• Kubernetes detection: audit logs, runtime telemetry, and workload identity.
• Knowledge of endpoint security (MacOS) and detection and response techniques.
• Hands-on incident experience: on call, led incidents, and written postmortems.
• Strong written and verbal communication.
• A clear point of view on AI/LLM security and hands-on experience defending relevant threats.
• Bonus: prior experience with LLM red-teaming or AI threat defense.

Skills

Python

TypeScript

Go

Incident response

Communication

Kubernetes

Endpoint security

AI/LLM security

Tools

AWS

Azure

GCP

Job description

Braintrust is seeking a Detection and Response engineer to design and build security systems that identify threats across the Braintrust stack. You will run detection-as-code, lead incident response, and stay ahead with real-time threat intelligence.

You will work with Python/TypeScript/Go, AWS, Kubernetes, and cloud endpoints; build telemetry pipelines; investigate incidents; write postmortems; and contribute to AI/LLM security controls.