Detection and Response Engineer

About the role

We’re looking for a Detection and Response engineer to design and build systems that identify, analyze, and eradicate threats across the Braintrust stack. You’ll practice detection-as-code, run security operations with agents, lead incident response, and stay ahead of the curve incorporating real-time threat intelligence. Have a big impact with a small team that has outsized capabilities.

What you'll do

• Build security telemetry pipelines across cloud execution environments (ECS/K8s), CI/CD systems, identity systems, endpoints, and agentic workloads
• Continuously improve detections for attacks, abuse, and anomalous behavior
• Own the alert pipeline end-to-end and keep signal-to-noise high
• Lead incident response and participate in on-call: triage, scope, contain, and remediate incidents, then write postmortems that produce durable improvements
• Hunt proactively for threats and build the tooling for turning evidence into new detections
• Build agents that triage alerts, enrich findings, gather evidence, and scope incidents, with human-in-the-loop controls and evals that keep the automation trustworthy
• Run vulnerability response, evaluating impact and driving remediation across our infrastructure

Ideal candidate credentials

• Proficient in modern backend technologies and comfortable writing real code in Python, TypeScript, or Go
• AWS experience (IAM, VPC, KMS, GuardDuty, CloudTrail) and working fluency in at least one of Azure or GCP
• Kubernetes detection

experience

audit logs, runtime telemetry, and workload identity

• Knowledge of endpoint security (MacOS) and detection and response techniques
• Hands-on incident

experience

you’ve been on call, led incidents, and written postmortems

• Strong written and verbal communication
• A clear point of view on AI/LLM security and hands-on experience defending relevant threats
• Bonus: prior experience with LLM red-teaming, agent sandbox research, or other AI-relevant security threat defense