Detection and Response Engineer

Braintrust • Seattle, WA

2d

About The Position

Braintrust is seeking a Detection and Response Engineer to design and build systems that identify, analyze, and eradicate threats across its technology stack. The role practices detection-as-code, operates security workflows with agents, leads incident response, and incorporates real-time threat intelligence. It offers the opportunity to have a significant impact on a small team.

The engineer will build security telemetry pipelines across cloud execution environments, CI/CD systems, identity systems, endpoints, and agentic workloads; improve detections; own the alert pipeline; lead incident response and participate in on-call; proactively hunt for threats; develop agents to assist with alert triage and incident investigation; and coordinate vulnerability response and remediation.

Requirements

• Proficiency in modern backend technologies and ability to write production code in Python, TypeScript, or Go.
• AWS experience, including IAM, VPC, KMS, GuardDuty, and CloudTrail.
• Working fluency in at least one of Azure or GCP.
• Kubernetes detection experience, including audit logs, runtime telemetry, and workload identity.
• Knowledge of endpoint security for macOS and detection and response techniques.
• Hands-on incident experience, including on-call work, leading incidents, and writing postmortems.
• Strong written and verbal communication.
• A clear point of view on AI/LLM security and hands-on experience defending against relevant threats.

Nice To Haves

• Prior experience with LLM red-teaming, agent sandbox research, or other AI-relevant security threat defense.

Responsibilities

• Build security telemetry pipelines across cloud execution environments (ECS/K8s), CI/CD systems, identity systems, endpoints, and agentic workloads.
• Continuously improve detections for attacks, abuse, and anomalous behavior.
• Own the alert pipeline end-to-end and maintain a high signal-to-noise ratio.
• Lead incident response and participate in on-call, including triaging, scoping, containing, and remediating incidents.
• Write incident postmortems that drive durable improvements.
• Proactively hunt for threats and build tooling to turn evidence into new detections.
• Build agents that triage alerts, enrich findings, gather evidence, and scope incidents, using human-in-the-loop controls and evaluations.
• Run vulnerability response, evaluate impact, and drive remediation across infrastructure.

Benefits

• Medical, dental, and vision insurance.
• Daily lunch, snacks, and beverages.
• Flexible time off.
• Competitive salary and equity.
• Wi-Fi and cellphone stipend.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed