Senior Security Engineer, Detection & Response

Angi•Denver, CO

3d•Remote

About The Position

Angi is seeking a Senior Security Engineer to own detection and response as an engineering discipline. The role builds and maintains detections and the automation that processes them, owns the security log pipeline, and participates in incident response through a 24/7 on-call rotation. Detection coverage spans AWS, endpoint, identity, SaaS, Angi’s AI gateway, and application protection for marketplace abuse. The engineer will develop triage automation and verification for AI-assisted workflows, extend monitoring to agentic AI products, and ship security code using software engineering practices. The position also owns technical detection controls for compliance frameworks such as PCI DSS and partners with platform and product teams to ensure services launch with telemetry, threat models, and response playbooks. This is a remote role; applicants should be located in the Eastern or Central time zones to align with the team’s working hours.

Requirements

At least 5 years of experience on a security team supporting product or engineering functions, cloud infrastructure, and corporate infrastructure development.
Software engineering experience, preferably with Python, and an engineering mindset for building reliable, maintainable security infrastructure using CI/CD practices.
Experience with analytics and observability tools such as Grafana, Looker, New Relic, or similar, including building coverage and precision dashboards.
Hands-on experience with AWS and infrastructure as code such as Terraform, CloudFormation, or equivalent.
Working knowledge of EDR, SIEM, and SOAR platforms and their APIs.
Hands-on experience with containers and Kubernetes, including detection and forensics in those environments.
Experience owning incidents end to end, from paging and diagnosis through remediation and postmortem.
Some exposure to LLM or agentic system security, such as prompt injection, agent identity, or data exfiltration via AI systems.
Daily, fluent use of AI-assisted coding or security tools and the ability to explain how AI output is directed and verified.
Strong written communication skills for detection documentation, postmortems, and design feedback.

Nice To Haves

Comfort executing the technical side of a compliance framework such as PCI, SOX, or similar.

Responsibilities

Build and own detections across AWS, EDR, identity, SaaS, and the AI gateway, managing coverage, precision, and latency across each rule’s lifecycle.
Own the security log pipeline and make audit and security logs centrally available to teams for triage, analysis, and incident response.
Develop application-protection detections for account takeover, credential stuffing, and abuse of the two-sided marketplace.
Build triage automation for enrichment, correlation, containment, and evidence capture, aiming to resolve a median alert without human intervention.
Use LLM and agentic tooling where appropriate, and build verification mechanisms to make its output trustworthy.
Evaluate whether to buy, build, extend, or replace security tools, and ship code in a repository rather than relying only on console configuration.
Extend detection coverage to agentic AI products, including anomalous agent behavior, prompt injection, tool-call abuse, and data exfiltration.
Participate in all facets of incident response through a 24/7 on-call rotation.
Own technical detection controls retained by InfoSec for compliance, including PCI DSS tamper-detection monitoring, log integrity, and alerting coverage.
Partner with platform and product teams to integrate telemetry, threat models, and response playbooks into new services during their design.