Senior Security Engineer, Detection & Response

Aircall.io, Inc.•Seattle, WA

19h•$180,000 - $220,000

About The Position

Aircall is seeking a Senior Security Engineer, Detection and Response to develop, scale, and evolve the company's threat detection and response capabilities. This is an owner-operator role where the individual will be responsible for building detections from scratch, leading investigations, and driving the maturity of the detection program. The role involves building and running the detection platform, including ingestion pipelines, Terraform for AWS accounts, retention and cost management, and automation. Approximately two-thirds of the work will focus on software and platform engineering, with the remaining third dedicated to investigation, incident response, and threat hunting. The role requires writing production Python and Terraform weekly, in close collaboration with product security, cloud, and infrastructure security teams. The team has experience building AI SOC & IR agents and is applying these lessons to protect customer-facing AI products.

Requirements

5+ years of hands-on experience in security operations, detection engineering, incident response, threat hunting, or similar fields, or an equivalent combination.
Production-grade Python and Terraform. A meaningful majority of this role's output is building detections managed in code, logging pipelines and custom security tools to scale sec ops. You should be able to point to services or Lambdas you built and Terraform modules you own and have maintained in production.
Deep knowledge of adversarial tactics, techniques, and procedures, threat actor behavior, ATT&CK framework.
Proven experience building detections from scratch rather than only tuning commercial alerts into a production-quality detection with a low false positive rate.
Hands-on experience with SIEM or log analytics platforms and data lake technologies (OpenSearch, Elasticsearch, Clickhouse, Sentinel, Splunk, Datadog, AWS Athena, Azure synapse, Databricks or equivalent) and alerting/monitoring tooling.
Cloud-first Azure, GCP, AWS experience. Beyond instrumenting detections across cloud workloads, this role provisions and owns production security infrastructure in AWS: VPCs, IAM, networking, private service endpoints.
Experience in digital forensics, host-based detection, endpoint telemetry, process and network visibility, and cloud observability.
Experience responding to incidents in production environments: investigating logs, building timelines, establishing root cause, and containing.
Familiarity with security automation and orchestration, playbooks, response automation, and alert triage workflows.
Comfort as the primary owner of a domain. You will lead detection and response engineering, set your own priorities and move confidently where documentation is thin or stale.
Strong communication skills; the ability to translate complex detection logic, trade-offs and risk to engineers and to leadership.
A high degree of autonomy, initiative, and ownership, with the ability to drive entire initiatives with minimal oversight.

Nice To Haves

Experience building on or securing LLM and agent systems — Azure foundry, Bedrock/AgentCore, LangGraph, guardrails, policy-based authorization, prompt-injection defense, and agent evaluation.
Purple/Red team, App Sec or Production security experience. To develop proof of concepts against systems and simulate attacks, test controls and protections effectiveness. This position is not a full time red team position.
Vulnerability management program ownership (Wiz or comparable CSPM, bug bounty triage, SLA enforcement).
Fraud and abuse investigation in a multi-tenant SaaS product — account takeover, credential stuffing, trial and promo abuse, toll fraud.
Open source detection tooling contributions or public speaking at security conferences

Responsibilities

Leading direction and strategy of the DART program at Aircall
Lead end-to-end development of detection logic: from threat modeling and hypothesis to writing, testing, simulation, tuning, and deploying detection rules and alerts across logs, telemetry, host, network, and cloud.
Own the security data platform end to end. Operate and extend the SIEM and its ingestion pipelines, parsers, enrichment and normalization, defined as infrastructure-as-code and promoted from sandbox to production. Own its cost and capacity envelope and make the retention-versus-spend calls.
Experiment and build unique tools at the front of the security space that solve significant security challenges.
Expand and ship new security AI- and agent-based tooling for alert triage, investigation and detection building, including its authorization model, guardrails, evaluation harness and tracing.
Conduct threat hunts proactively in company wide and production environments, discovering anomalies and attacker behaviors before they escalate.
Lead incident response: investigate, contain, remediate, and perform root cause analysis. Drive post-incident reviews and feed lessons learned back into detection strategy.
Assess security around new product features, including AI- and LLM-backed services and opportunities for detections or protections
Author and maintain detection documentation, runbooks, alert definitions, tuning guidelines, and metrics.
Collaborate cross-functionally with Engineering, Product, Fraud, Privacy and Legal
Participate in on-call and threat-response rotations; escalate, coordinate, and remove blockers during high-severity events.
Stay current on attacker techniques (MITRE ATT&CK, red team reports, threat intel) and propose new detection patterns or responses accordingly.
Participate in hiring and interview evaluation of Security and Infrastructure engineering candidates, and in team growth.