Senior Security Operations / Detection Engineer

LiteLLM • San Francisco, CA

2d

About The Position

LiteLLM is hiring a Senior Security Operations / Detection Engineer to build and own detection and response across its infrastructure. This hands-on individual contributor role owns log pipelines, detections, runbooks, alert handling, and incident coordination. The role reports to the security lead and works directly with engineering to build and operate a detection and response function suited to a small company. San Francisco is preferred. The engineer will own their roadmap, build and run the tooling, lead incidents with incomplete information, and communicate independently with engineers, customers, and vendors across time zones.

Requirements

• 5+ years of relevant experience.
• Experience building a detection and response function from scratch.
• Hands-on experience building and tuning SIEM detections, preferably in Splunk, and managing them as code.
• Experience building log pipelines from cloud and CI systems.
• Strong familiarity with GitHub, Okta, and cloud audit logs, including their limitations.
• Experience leading incidents end-to-end and making containment decisions based on partial information.
• Understanding of OAuth, personal access tokens, OIDC, and how attackers abuse authentication systems.
• Ability to write Python scripts to investigate incidents and automate security operations.
• Strong independent judgment and experience owning priorities with limited oversight.
• Clear communication under pressure and willingness to surface bad news early.
• Availability to overlap with Pacific working hours.

Nice To Haves

• Experience building a detection and response function at a growing technology company.
• Experience in managed detection and response or incident response across multiple customer environments.
• Experience partnering closely with engineers in a small, fast-moving team.

Responsibilities

• Build and maintain security log pipelines and document coverage gaps.
• Build, validate, and tune detections across cloud infrastructure, CI systems, identity providers, and internal services.
• Manage detections as code, with clear documentation and ongoing maintenance.
• Write and maintain a runbook for every alert.
• Define severity-based alert response SLAs and own performance against them.
• Lead incidents from investigation and containment through recovery and follow-up.
• Produce clear incident timelines, reports, and recommendations.
• Measure and improve time to detect and contain threats.
• Automate detection of unexpected identity and access changes and drive remediation.
• Prioritize improvements based on risk and the needs of a small engineering organization.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed