Staff Security Engineer, Detection Engineering

CoreWeave•Bellevue, WA

About The Position

CoreWeave is hiring a staff-level security engineer and technical leader to drive the strategy, architecture, and execution of threat detection and response capabilities across AI infrastructure. The role combines high-impact individual-contributor work with leading, mentoring, and empowering a team of detection engineers. The successful candidate will establish technical standards and operational best practices, align detection initiatives with security, infrastructure, and enterprise AI goals, and build scalable, automated, resilient detection systems. The role focuses on Detection-as-Code, including automated pipelines, high-fidelity detection logic, CI/CD testing, and continuous coverage validation. It also involves building scalable security data lakes and log-ingestion pipelines for multi-cloud and Kubernetes telemetry at petabyte scale; integrating AI and LLM-driven analytics and triage workflows; and working with infrastructure and product teams to identify root-cause vulnerabilities, automate response playbooks, and reduce recurring security risks. The position includes mentorship, technical influence across teams, post-incident reviews, and communicating detection strategy to leadership. This is not a typical 9-to-5 role. On-call participation outside business hours, including weekends and holidays, and all-hands participation during active incidents are expected. The role requires access to export-controlled information, subject to applicable U.S. export-control eligibility requirements.

Requirements

Proven experience in a Staff-level or Technical Lead capacity, guiding engineering teams and defining multi-year detection strategies.
Demonstrated experience implementing Detection-as-Code paradigms, automated CI/CD security pipelines, and detection engineering frameworks.
Extensive experience designing and using security data lakes and distributed log-ingestion pipelines for high-throughput cloud environments.
Deep expertise in Linux internals, Kubernetes runtime security (including eBPF and Falco), and cloud-native container security.
Proficiency in software development and query languages such as Python, Go, SQL, and KQL to build tooling and automated remediation engines.
Strong leadership skills and a passion for mentoring junior- and mid-level engineers and establishing strong engineering practices.
Must meet applicable U.S. export-control eligibility requirements for access to export-controlled information.
Willingness to participate in on-call hours, including weekends and holidays, and in active incident response outside standard business hours.

Nice To Haves

Experience applying AI, machine learning, or LLMs to detection engineering, threat-intelligence synthesis, or automated incident triage.
Active open-source security contributions or public technical research in threat detection, Kubernetes security, or cloud defense.
Prior leadership or team-lead experience in high-growth cloud or AI hyperscaler environments.

Responsibilities

Lead, mentor, and empower a team of detection engineers, fostering technical excellence, continuous growth, and an inclusive engineering culture.
Architect and guide long-term detection strategies at scale, establishing technical standards and operational best practices.
Drive cross-functional technical strategy, aligning detection engineering with security, infrastructure, and enterprise AI goals.
Design and build resilient, automated Detection-as-Code pipelines, including high-fidelity detection logic, CI/CD testing frameworks, and continuous coverage validation.
Partner with Security and Data Science to deliver scalable log-ingestion pipelines and security data lake infrastructure for aggregating, parsing, and analyzing multi-cloud and Kubernetes telemetry at petabyte scale.
Integrate AI- and LLM-driven analytics and automated triage workflows to improve threat intelligence, anomaly detection, and incident-response speed.
Partner with infrastructure and product teams to identify root-cause vulnerabilities, automate incident-response playbooks, and eliminate recurring security risks.
Provide mentorship and technical leadership across teams, set engineering standards, drive post-incident reviews, and represent detection strategy to leadership.
Participate in on-call coverage, including weekends and holidays, and support active incidents outside business hours.

Benefits

Medical, dental, and vision insurance, 100% paid for by CoreWeave for the stated U.S. full-time offerings.
Company-paid life insurance.
Voluntary supplemental life insurance.
Short- and long-term disability insurance.
Flexible Spending Account.
Health Savings Account.
Tuition reimbursement.
Ability to participate in the Employee Stock Purchase Program (ESPP).
Mental wellness benefits through Spring Health.
Family-forming support through Carrot.
Paid parental leave.
Flexible, full-service childcare support with Kinside.
401(k) with an employer match.
Flexible PTO.
Discretionary bonus and equity awards, subject to eligibility.
Catered lunch each day at office and data center locations.
Casual work environment.