Detection & Response Engineer
Runway · Remote · Remote ·
COMPENSATION
$240k – $290k
Listed on the employer's job board (Ashby)
- Fully remote or hybrid
- Security engineering focus
- Python, TypeScript, Rust
- Cloud & Kubernetes security
- Incident response ownership
Join Runway's Security team to protect frontier video models, large training datasets, and research compute. You will own the detection and response program end-to-end, treating detections as code and response as automation.
This position requires partnering with platform and research engineers to ensure new systems ship with logging and response playbooks. You will handle everything from alert triage to post-incident reviews and compliance evidence.
What you'll do
- Own detection and response lifecycle from logging to incident recovery
- Write and tune detections as code across cloud, Kubernetes, and SaaS
- Lead incident response including containment, forensics, and reviews
- Build automation for triage, enrichment, and evidence collection
- Monitor AI agents and developer tooling for concrete telemetry
- Partner with engineers to embed logging and playbooks in new systems
- Conduct threat hunts and tabletop exercises to identify gaps
- Provide metrics for SOC 2, ISO 27001, and customer security reviews
- Participate in on-call rotation for security incidents
What you'll need
- Hands-on experience triaging live alerts and leading investigations
- Experience building and tuning detections in modern SIEMs as code
- Knowledge of attacker tactics in cloud and Kubernetes environments
- Proficiency in Python, TypeScript, Rust, or similar for automation
- Familiarity with major cloud platforms and Kubernetes audit logs
- Strong writing skills for timelines, documentation, and updates
- Judgment on alerting thresholds, automation, and escalation
Nice to have
- Experience monitoring GPU or HPC-style infrastructure
- Background in detections for AI agents or LLM tooling
- Cloud forensics experience including disk and memory acquisition
- Published open source detection content
Stack
- Python
- TypeScript
- Rust
- Kubernetes
- SIEM
- Cloud Platforms
How you'll work
- Open to hiring remote candidates worldwide
- Offices in New York, San Francisco, Seattle, London, Paris, Tel Aviv
- On-call rotation required for security incidents
What you get
- Competitive market salary based on experience
- Commitment to pay equity and internal fairness
- Inclusive workplace supporting diverse backgrounds