Threat Detection & Response Engineer (AI-Driven)

Headway; Oregon; Hybrid; USD 120,000 - 180,000; Full time

Job summary

Headway is seeking a Security Engineer on the Detection & Response team to protect therapists, patients, and payer partners across our production and corporate environments. You will build detections, respond to incidents, and advance automation and AI tooling while documenting playbooks and threat intel.

You’ll collaborate with engineering and security teams to scale capabilities, improve logging, and ensure robust incident response in a fast-paced, mission-driven environment.

Qualifications

• The candidate has 1-2+ years dedicated to security response or security-adjacent work.
• 4-5+ years in DevOps, IT, software engineering with security responsibilities.
• Experience with SIEM/observability in cloud or distributed environments.
• Ability to balance automation with human oversight.
• Able to work autonomously in a high-impact environment.
• Strong cross-functional collaboration with engineers and non-technical teams.
• Driven by Headway's mission to increase access to mental healthcare.

Responsibilities

• Build and refine detections, logging, and telemetry for real-time visibility.
• Lead incident response activities, threat hunting, and threat modeling.
• Develop AI-forward security tooling and automation where appropriate.
• Triage security alerts and maintain alert pipelines.
• Contribute to on-call rotation, runbooks, and security docs.
• Document detections and threat intel for knowledge sharing.

Skills

Security engineering

Automation

Scripting

Cross-functional collaboration

Tools

Python

TypeScript

AWS

PostgreSQL

Datadog

GitHub

Semgrep

Tines

Job description

Headway is seeking a Security Engineer on the Detection & Response team to protect therapists, patients, and payer partners across our production and corporate environments. You will build detections, respond to incidents, and advance automation and AI tooling while documenting playbooks and threat intel.

You’ll collaborate with engineering and security teams to scale capabilities, improve logging, and ensure robust incident response in a fast-paced, mission-driven environment.