Threat Detection & Response Engineer (Remote)

Runway Financial, Inc.; Northern (KY); Hybrid; USD 150,000 - 230,000; Full time

Job summary

Runway is seeking a Detection & Response Engineer to own how we detect and stop attacks across our infrastructure, research environment, and products. You’ll build the detection program end to end, partner with platform and research teams, and shape how this function grows within a fast-moving AI-focused environment.

You’ll write detections as code, automate responses, and implement telemetry to support security reviews and customer trust.

Qualifications

• Hands-on incident response experience.
• Experience building and tuning detections in a modern SIEM, ideally managed as code.
• Familiarity with cloud and Kubernetes environments and logs.
• Strong scripting and automation abilities.
• Clear writing and incident documentation.

Responsibilities

• Own detection and response end to end: logging, alerting, triage, and recovery.
• Write and tune detections across cloud, Kubernetes, IAM, endpoints, and SaaS.
• Lead incident response from alert to containment and forensics; produce post-incident reviews.
• Build automation to reduce toil in triage; enable evidence collection and automation with LLM tooling.
• Monitor AI agents and developer tooling; turn observations into telemetry and controls.
• Collaborate with platform and research to ship systems with logging and playbooks from day one.
• Run threat hunts and tabletop exercises; fix identified gaps.
• Generate evidence for SOC 2 / ISO 27001 with GRC support.
• Participate in on-call rotation for security incidents.

Skills

Incident response

Detections as code

Python

Typescript

Rust

Cloud platforms

Kubernetes

RBAC

Log analysis

Security tooling automation

Tools

SIEM

Job description

Runway is seeking a Detection & Response Engineer to own how we detect and stop attacks across our infrastructure, research environment, and products. You’ll build the detection program end to end, partner with platform and research teams, and shape how this function grows within a fast-moving AI-focused environment.

You’ll write detections as code, automate responses, and implement telemetry to support security reviews and customer trust.