Detection and Response Engineer
Modal · New York
About this role
**Detection and Response Engineer** **About Modal:** Modal is building a new infrastructure layer for AI. Our customers include Lovable, Ramp, Cognition, DoorDash, and Suno. We recently raised a $355M Series C at a $4.65B valuation and have crossed $300M+ ARR. **The Role:** We're seeking a Detection & Response Engineer to build systems that identify, investigate, and respond to threats across our platform. This engineering role focuses on automation, detection design, investigation tooling, and response capabilities that scale with our infrastructure. **What You'll Work On:** • **Detection Engineering** – Design high-fidelity detections for attacks, abuse, and anomalous behavior; improve detections based on telemetry and incident learnings • **Incident Response** – Lead investigations across production infrastructure and cloud environments; build playbooks and automation to reduce investigation time • **Security Tooling & Automation** – Build internal tools leveraging LLMs to automate analysis and surface actionable insights from security telemetry • **Engineering Partnership** – Partner with teams to ensure new systems are observable and secure by default **What We're Looking For:** • Experience in detection engineering, incident response, or security-focused software engineering • Strong software engineering skills with production systems experience • Experience investigating security incidents in cloud-native or distributed environments • Familiarity with modern cloud infrastructure, Kubernetes, Linux, and networking • Experience building detections using logs, telemetry, or large-scale event data • Strong SQL skills for security event investigation • Interest in applying AI/LLMs to detection and response • Strong written and verbal communication **Preferred:** AI/LLM-powered security tooling, SIEM/SOAR/EDR platforms, Kubernetes security, threat hunting, or experience in high-growth engineering organizations
Listing freshness
CronJobs last confirmed this listing 17h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.