Senior Security Engineer, Detection & Response

Angi•Denver, CO

18h•$150,000 - $225,000•Remote

About The Position

Angi is hiring a Senior Security Engineer to own detection and response as an engineering discipline across cloud, endpoint, identity, SaaS, application protection, and AI-agent systems. The role includes building detections and response automation, owning the centralized security log pipeline, and improving alert coverage, precision, and latency. The engineer will build and maintain software-based security infrastructure, dashboards, triage workflows, and verification mechanisms for automated outcomes. The position also extends security monitoring to Angi’s agentic AI products, including detection of prompt injection, tool-call abuse, and data exfiltration. The engineer will participate in the full incident response lifecycle and a 24/7 on-call rotation, maintain detection-related technical controls for compliance frameworks such as PCI DSS, and work with platform and product teams to incorporate telemetry, threat models, and response playbooks into new services. The role is remote, with applicants sought in eastern or central time zones to align with team working hours.

Requirements

At least 5 years of experience working on a security team supporting product or engineering functions, cloud infrastructure, and corporate infrastructure development.
Software engineering experience, preferably with Python, and an engineering mindset for building reliable, maintainable security infrastructure using CI/CD practices.
Experience with analytics and observability tools such as Grafana, Looker, NewRelic, or similar, including building coverage and precision dashboards.
Hands-on experience with AWS and infrastructure as code, such as Terraform, CloudFormation, or equivalent.
Working knowledge of EDR, SIEM, and SOAR platforms and their APIs.
Hands-on experience with containers and Kubernetes, including detection and forensics.
Sound build-versus-buy judgment and comfort using, extending, wrapping, or replacing tools.
Experience owning incidents end to end, from page and diagnosis through fix and postmortem.
Some exposure to LLM or agentic system security, including prompt injection, agent identity, or data exfiltration through AI systems.
Fluent daily use of AI-assisted coding or security tools, with the ability to explain how AI output is directed and verified.
Strong written communication skills for detection documentation, postmortems, and design feedback.

Nice To Haves

Comfort executing the technical side of a compliance framework such as PCI, SOX, or similar.

Responsibilities

Build and own detections across AWS services including GuardDuty, CloudTrail, and SecurityHub, as well as EDR, identity, SaaS, and the AI gateway.
Manage detection coverage, precision, and latency across the lifecycle of detection rules.
Own the security log pipeline and ensure audit and security logs are centrally available to teams for triage, analysis, and incident response.
Own detection on the application protection layer, including account takeover, credential stuffing, and marketplace abuse patterns.
Build triage capabilities for enrichment, correlation, containment, and evidence capture, with the goal of resolving typical alerts without human intervention.
Use LLM and agentic tooling where appropriate and own verification mechanisms that make automated output trustworthy.
Select, build, extend, or replace security tools as appropriate, and ship code in a repository.
Extend detection coverage to Angi’s agentic AI products, including anomalous agent behavior, prompt injection attempts, tool-call abuse, and data exfiltration.
Participate in all facets of the incident response lifecycle and a 24/7 on-call rotation.
Own technical detection controls required by compliance frameworks such as PCI DSS, including tamper-detection monitoring, log integrity, and alerting coverage.
Partner with platform and product teams to ensure new services include telemetry, threat models, and response playbooks.