Senior Security Engineer - Detection & Response

Lambda•San Francisco, CA

2d•$266,000 - $395,000•Hybrid

About The Position

Lambda is hiring a Senior Security Engineer for its Detection & Response team. The role protects Lambda’s training data, model weights, customer inputs, and the infrastructure powering its AI cloud. Reporting to the Security Engineering Lead, this hands-on technical expert will help move security operations from reactive response toward proactive threat management, with an emphasis on automation, threat hunting, detection engineering, and incident response capability building. The engineer will develop enterprise-grade detection capabilities, automate response workflows, and harden multi-cloud and bare-metal infrastructure. The position also offers an opportunity to use Lambda-hosted LLMs to build AI-powered security solutions. The role focuses on maintaining operational resilience through automation, rapid investigation and mitigation, and ongoing improvement of detection and response capabilities. It includes participation in an engineering on-call rotation for 24/7 readiness. The position requires presence in Lambda’s Bellevue, San Francisco, or San Jose office four days per week; Tuesday is currently the designated work-from-home day.

Requirements

At least 5 years of hands-on security engineering experience specializing in detection engineering, threat hunting, or digital forensics and incident response (DFIR).
Strong programming or scripting proficiency in languages such as Python, Go, Rust, or Bash, with experience building automated security tools and pipelines.
Deep technical knowledge of cloud infrastructure security (AWS/GCP), Linux system internals, container runtime security, and network telemetry.
Understanding of the security requirements of a cloud infrastructure provider.
Experience writing detection rules using technologies such as SIEM, YARA, Sigma, Falco, or EDR queries, and managing detections through software development best practices.
Hands-on experience conducting forensic investigations and triaging complex, multi-stage attacks across cloud environments.
Strong technical communication skills, including the ability to document vulnerabilities, incident post-mortems, and architectural designs clearly.
Ability to work in high-ambiguity environments, build structure, and execute at startup pace.

Nice To Haves

Interest in using direct access to state-of-the-art LLMs to advance security operations, including AI-powered threat hunting, automated security report generation, and intelligent vulnerability prioritization.
Experience building detection and response programs at AI/ML companies.
Experience using AI/ML for security operations automation.
Experience scaling security during periods of hypergrowth, such as 10x growth phases.
Experience with eBPF, kernel-level telemetry, or specialized bare-metal host security tools.
Experience making build-versus-buy decisions for security tooling.
Experience driving or providing significant evidence for compliance audits such as SOC 2, ISO 27001, PCI-DSS, HIPAA/HITECH, or FedRAMP.

Responsibilities

Design, build, and maintain detection rules, signatures, and behavioral analytics across cloud, bare-metal, and internal infrastructure.
Conduct proactive threat hunting to identify threat actors, novel attack vectors, and zero-day vulnerabilities across multi-cloud environments and AI workloads.
Develop detection logic and playbooks as code to reduce manual triage and improve detection and response times.
Build AI-powered detection and investigation workflows using Lambda’s internal LLM infrastructure to automate log analysis and add threat intelligence context.
Lead technical incident response investigations, including forensic analysis, root-cause identification, and containment.
Architect automated response capabilities and SOAR pipelines to isolate compromised assets and revoke compromised credentials programmatically.
Partner with Platform and Infrastructure engineering teams to harden systems, build security instrumentation, and ensure telemetry coverage across services.
Participate in an engineering on-call rotation to support 24/7 operational readiness and rapid incident containment.
Conduct post-incident reviews, identify technical learnings, drive root-cause remediation, and prevent recurring incidents.
Mentor junior and mid-level security engineers and promote best practices in detection engineering and automation.