Threat Detection and Response Engineering Manager
OpenAI · San Francisco
About this role
**ABOUT THE TEAM** OpenAI’s mission depends on developing and deploying powerful AI responsibly. Security makes that possible by protecting research, people, products, and users while enabling progress. The team defends sensitive research and intellectual property, customer data, and the infrastructure behind frontier AI—from GPU supercomputing and multicloud environments to datacenters and emerging agent systems. Threat Detection Engineering builds and operates detections and investigative workflows that turn adversary activity into effective response. **ABOUT THE ROLE** OpenAI is seeking a hands-on technical leader to guide engineers who identify and investigate threats to OpenAI and build capabilities to contain them. You will hire and develop engineers, set technical direction, and prioritize risks to OpenAI’s intellectual property, customer data, and critical infrastructure. Your team will take an **agent-first** approach across the detection and response lifecycle—using OpenAI’s models to develop detections, triage signals, investigate suspicious activity, and support bounded response and continuous improvement. You’ll turn advances in model capability into dependable defenses, own their effectiveness, and partner with security, research, and infrastructure teams to ensure findings lead to effective action. You will also define where agents can act independently and where human judgment and approval are essential. **IN THIS ROLE, YOU WILL** - **Hire, coach, and develop engineers**: Set clear expectations, provide regular feedback, grow technical leadership, and build a team that rigorously reviews work and learns from missed detections and noisy signals. - **Set a threat-informed roadmap**: Prioritize detection work based on how external and internal actors could target systems used to train/evaluate frontier models, production inference services, datacenter hardware/networks, and employee devices/identities/apps. - **Own detection + investigation end-to-end**: Embed agent-driven triage and investigation in the detections you operate. Surface findings when evidence indicates a likely threat that warrants action. When formal incident response is needed, bring evidence to the **Security Incident Response Team (SIRT)** and support their investigation. - **Build response and containment capabilities**: Work with infrastructure and system owners to develop and test controls responders need to contain threats. Define when human approval is required and how to verify containment success. - **Apply models across the detection engineering lifecycle**: Use OpenAI’s models to develop threat hypotheses, author/test detections, deploy/tune them, and incorporate investigation findings into improved coverage. Evaluate agent and workflow effectiveness. - **Turn model advances into tested defenses**: Prototype new approaches using OpenAI’s models, evaluate against realistic adversary behavior and analyst baselines, and move successful experiments into production. - **Anticipate emerging threats**: Translate adversary intelligence and incident findings into testable detection hypotheses. Partner with researchers and infrastructure owners on risks specific to a frontier AI lab (including increasingly capable agents operating across systems with access to sensitive research). - **Establish the visibility needed to detect, investigate, and respond**: Partner with Security Observability and infrastructure owners to define telemetry and forensic da
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.