Staff Security Engineer, Detection and Response

Ambience Healthcare • San Francisco, CA

9h • Hybrid

About The Position

Ambience deploys clinical AI agents that operate in real time across the nation's largest health systems. When your product has autonomous access to infrastructure, credentials, and patient data at scale, detection and response isn't a support function, it's core to our business. You'll be our first dedicated D&R hire. You'll build the detection engineering and incident response program from scratch in a HIPAA-regulated, AI-native environment where the threat surface includes LLM-powered agents operating across infrastructure. You'll write production code, architect security data pipelines, and define what good looks like for D&R at a company where the attack surface is genuinely novel and rapidly evolving.

Requirements

• 5+ years in detection engineering, incident response, or a closely related security engineering role
• Strong programming skills in Python, Go, or Rust. You ship production code and internal tooling, not just scripts
• Deep experience with AWS (or comparable cloud) and its native security services; comfortable operating in Kubernetes environments
• You've built or significantly matured a detection engineering program: authored detections, managed rule lifecycles, measured coverage and precision
• You think in terms of attacker tradecraft and can translate real-world intrusion patterns into detections that matter
• Solid fundamentals in networking, infrastructure security, and identity/access management
• You set priorities with risk and operational impact, not just coverage checklists

Nice To Haves

• Worked with LLMs or agent-based workflows to automate security operations
• Contributed to open-source security projects or published research
• Built security programs at a startup where there was no playbook to follow

Responsibilities

• Detection Engineering: Stand up a detection pipeline across our highest-risk surfaces: AWS, Kubernetes, Okta, endpoints, and SaaS tools. Author environment-tuned detections with a full rule lifecycle that produces high-signal alerting the on-call team actually trusts.
• Incident Response: Build the IR program end-to-end: playbooks, escalation paths, evidence collection, post-mortems. Procedures that are documented, rehearsed, and satisfy both operational and HIPAA needs.
• Security Tooling & Automation: Evaluate, deploy, and integrate the core D&R stack (SIEM, EDR, SOAR, cloud-native services). Build internal tooling and automation that reduces response time and toil. Use LLMs where they genuinely accelerate detection, triage, or investigation.
• Agent Security: Detect and respond to threats unique to clinical AI systems and agentic workflows: abnormal tool access, credential abuse, data exfiltration, and novel attack patterns that don't show up in traditional threat models.

Benefits

• Comprehensive medical, dental, and vision coverage for you and your dependents
• 401(k) with a company match of up to 3% of base salary
• Parental leave to support your family needs
• Annual company-wide off-sites, team off-sites and regular team lunches and all-hands gatherings, with travel, lodging and meals covered
• Flexible time off with no annual cap, company-wide holidays and an annual holiday shutdown from December 24–January 1

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed