Detection & Response Engineer

Job not on LinkedIn

🔥 1 minute ago

🇺🇸 United States – Remote

💵 $240k - $290k / year

⏰ Full Time

🟡 Mid-level

🟠 Senior

👷🏻‍♀️ Engineer

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Runway

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2018

🤖 Artificial Intelligence

☁️ SaaS

📱 Media

Artificial Intelligence • SaaS • Media

Runway is a company building foundational "Real-World Intelligence" — large models and systems that can understand, simulate and act in the visual world. It offers three main product platforms built on these models: Runway Creative, an all‑in‑one cloud creative suite for generating and editing video, images and audio for individuals and teams; Runway Dev, an AI media platform and API for developers to run models, compose pipelines and trigger workflows; and Runway Robotics, a toolkit for photorealistic simulation, policy inference and synthetic data generation powered by their General World Model (GWM-1). Runway also publishes research (e. g. , GWM-1, Gen-4. 5 video model) and serves both individual creators and enterprise customers.

📋 Description

• Own detection and response end to end, including logging, alerting, triage, and recovery • Write and tune detections as code across cloud environments, Kubernetes, identity systems, endpoints, and SaaS • Measure detections by coverage and precision rather than alert volume • Lead incident response from initial alert through containment and forensics • Write post-incident reviews • Build automation for triage enrichment, correlation, containment actions, and evidence collection • Use LLM-based tooling where it withstands audit • Monitor AI agents and developer tooling and develop telemetry and controls • Partner with platform and research engineers to implement logging and response playbooks in new systems • Run threat hunts and tabletop exercises and remediate findings • Turn incident and detection metrics into evidence for SOC 2, ISO 27001, and enterprise customer security reviews • Work with the GRC team • Participate in a security incident on-call rotation • Report to the head of security and partner with platform and research engineers

🎯 Requirements

• Hands-on incident response experience, including triaging live alerts, leading investigations, and writing post-incident reports • Experience building and tuning detections in a modern SIEM, ideally managed as code • Working knowledge of attacker movement through cloud and Kubernetes environments, including IAM abuse, container escape, credential theft, and supply chain compromise • Ability to write Python, TypeScript, Rust, or another language to automate response work and connect security tools • Familiarity with at least one major cloud platform • Kubernetes knowledge covering audit logs, RBAC, and workload identity • Clear writing for incident timelines, detection documentation, and leadership updates • Judgment about alerting, automation, and escalation decisions • Participation in an on-call rotation for security incidents • Experience monitoring GPU or HPC-style infrastructure, research environments with large datasets, AI agents, LLM tooling, or MCP servers is advantageous • Cloud forensics experience, including disk and memory acquisition, cloud audit trail reconstruction, and chain of custody, is advantageous • Published open-source detection content is advantageous