Threat Detection & Incident Response Engineer

Wwshemi; San Francisco, New York, Seattle (CA, NY, WA); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

Daily lunch, snacks, and beverages

Flexible time off

Competitive salary and equity

Wifi & cellphone stipend

Job summary

Braintrust is seeking a Detection and Response engineer to design and build systems that identify, analyze, and eradicate threats across the Braintrust stack. You’ll practice detection-as-code, run security operations with agents, lead incident response, and stay ahead of the curve incorporating real-time threat intelligence.

Have a big impact with a small team that has outsized capabilities. You’ll build telemetry pipelines, improve detections, own the alert pipeline, and lead incident response

Qualifications

• Proficient in backend tech and comfortable coding in Python, TypeScript, or Go.
• Hands-on incident experience and ability to write postmortems.
• Experience with AWS and at least one of Azure or GCP.
• Kubernetes detection experience: audit logs and runtime telemetry.
• Knowledge of endpoint security (MacOS) and detection techniques.
• Strong written and verbal communication.
• Clear point of view on AI/LLM security and hands-on defense.
• Bonus: AI threat defense, red-teaming, or sandbox research.

Responsibilities

• Build security telemetry pipelines across cloud environments, CI/CD, identity, endpoints, and agent workloads.
• Continuously improve detections for attacks, abuse, and anomalies.
• Own the alert pipeline end-to-end and maximize signal-to-noise ratio.
• Lead incident response, participate in on-call, triage, scope, contain, and write postmortems.
• Hunt proactively for threats and build tooling to create new detections.
• Build agents that triage alerts, gather evidence, and scope incidents with human-in-the-loop controls.

Skills

Python

TypeScript

Go

Incident response

Threat hunting

Communication

AI/LLM security

Security tooling

Tools

AWS

Azure

GCP

Kubernetes

Job description

Braintrust is seeking a Detection and Response engineer to design and build systems that identify, analyze, and eradicate threats across the Braintrust stack. You’ll practice detection-as-code, run security operations with agents, lead incident response, and stay ahead of the curve incorporating real-time threat intelligence.

Have a big impact with a small team that has outsized capabilities. You’ll build telemetry pipelines, improve detections, own the alert pipeline, and lead incident response