Detection and Response Engineer
Braintrust · San Francisco
About this role
**Detection and Response Engineer** **About Braintrust** Agent observability platform used by teams at Notion, Stripe, Box, OpenAI, and Cloudflare to trace agents, identify issues, and run evaluations. **The Role** Design and build systems to identify, analyze, and eradicate threats across the Braintrust stack. Practice detection-as-code, run security operations with agents, lead incident response, and incorporate real-time threat intelligence. **What You'll Do** • Build security telemetry pipelines across cloud environments (ECS/K8s), CI/CD, identity systems, endpoints, and agentic workloads • Continuously improve detections for attacks, abuse, and anomalous behavior • Own alert pipeline end-to-end with high signal-to-noise ratio • Lead incident response and on-call: triage, scope, contain, remediate, and write postmortems • Proactively hunt for threats and build tooling for evidence-based detections • Build agents that triage alerts, enrich findings, and scope incidents with human-in-the-loop controls • Run vulnerability response and drive remediation across infrastructure **Ideal Candidate** • Proficient in Python, TypeScript, or Go • AWS experience (IAM, VPC, KMS, GuardDuty, CloudTrail); fluency in Azure or GCP • Kubernetes detection experience (audit logs, runtime telemetry, workload identity) • Endpoint security knowledge (MacOS) and detection/response techniques • Hands-on incident experience with on-call and postmortem writing • Strong written and verbal communication • Clear perspective on AI/LLM security with hands-on threat defense experience • *Bonus:* LLM red-teaming, agent sandbox research, or AI security experience **Benefits** Medical, dental, and vision insurance • Daily lunch, snacks, and beverages • Flexible time off • Competitive salary and equity • Wifi & cellphone stipend **Equal Opportunity Employer**
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.