Staff Security Engineer, AI-Driven Detection & Response

Fullscript

1d•Remote

About The Position

Fullscript is seeking a Staff Security Engineer to define and drive defensive threat detection, incident response, and AI-assisted security operations across its cloud infrastructure, identity, endpoints, and applications. The role is at the technical core of the Security function and will architect modern detection systems, use AI and machine learning to automate security operations workflows, and establish defensive testing practices for AI-related threats. The engineer will partner with Engineering and Platform teams to scale detection and response capabilities alongside Fullscript’s infrastructure. The position combines technical leadership in detection engineering and incident response with the design of AI-assisted investigation workflows, security automation, and defensive validation. It leads end-to-end investigations, develops response playbooks, operationalizes threat intelligence, and mentors Security Operations colleagues. The role participates in an on-call rotation for incidents outside business hours. Fullscript describes its workplace approach as “Wherever You Work Well,” allowing teammates to choose an office, home, or a combination of both. The company offers generous PTO, competitive pay, RRSP matching, flexible benefits, a wellness program, training and learning initiatives, and a discount on Fullscript products.

Requirements

At least 8 years of experience in detection engineering, incident response, or security engineering, with demonstrated leadership in shaping organizational security strategy.
Practical experience incorporating AI tooling into SecOps workflows and familiarity with detection strategies for AI-specific threat vectors.
Strong scripting and automation skills in Python, JavaScript, or similar, and experience building workflows in a SOAR-style or workflow automation platform.
Experience managing security controls as code, such as with Terraform, with changes made through peer review rather than manual console changes.
Experience securing cloud environments (AWS preferred) and modern SaaS and identity stacks.
Hands-on incident response experience, including triage, investigation, containment, and postmortem or playbook development.
Working knowledge of adversary tradecraft, including MITRE ATT&CK, and the ability to translate it into practical, tuned detections rather than noisy alerts.
Proven ability to partner directly with engineering and infrastructure teams to define telemetry and control requirements for systems outside the candidate’s ownership.
Excellent written communication skills, including the ability to turn investigation findings into clear, factual updates for technical and non-technical stakeholders.

Nice To Haves

Experience contributing to or building from open detection content, such as Sigma rules or community rule repositories.
Experience collaborating on red-team or purple-team exercises to validate detection coverage.
Experience supporting a healthcare, regulated, or otherwise highly sensitive-data environment.
Relevant certifications such as GCIH, GCFA, GCTI, or GCDA, or equivalent practical experience.

Responsibilities

Set the multi-quarter technical direction for detection and response and drive it across Security, Platform, and Engineering teams.
Architect, author, and maintain advanced detection logic across SIEM, cloud infrastructure, identity systems, endpoint protection, and AI/ML pipelines.
Establish detection coverage and defensive controls for emerging AI and agentic threat vectors, including prompt injection, tool misuse, and data exfiltration patterns.
Own the full detection rule lifecycle, from authoring and testing through tuning and retirement, and measure coverage, precision, false-positive rate, and time-to-detect.
Create and maintain dashboards and reporting on alert volume, response times, and trends.
Design and deploy AI-assisted investigation workflows using LLMs and automated agents to accelerate triage, context enrichment, and threat containment.
Build and extend internal security tooling for identity resolution, cross-source log correlation, and natural-language querying over security telemetry.
Automate handoffs between detection tooling and the ticketing system to move investigations from alert to resolution with minimal manual work.
Lead and support security investigations end-to-end, from initial triage through containment and resolution.
Mentor Security Operations team members and set standards for rule quality, detection-as-code practices, and investigation rigor.
Partner with teams across the business to investigate and remediate security escalations surfaced by Customer Support, Customer Delivery, and internal teams.
Maintain and improve response playbooks based on lessons learned from investigations.
Participate in an on-call rotation to respond to security incidents outside business hours.
Threat model new and existing systems, including AI agents and services, to identify risks, necessary detection telemetry, and response approaches.
Lead defensive testing, purple-teaming, and adversarial validation to assess alert fidelity and detection resilience against AI-driven threats.
Partner with Platform and Engineering teams to ensure new AI services and features expose logging and telemetry needed for security monitoring.
Evaluate authorization and access-control changes for security-relevant blast radius and drive remediation with the engineering teams that own affected systems.
Operationalize threat intelligence into actionable detections and tracked follow-up work.
Coordinate indicator-of-compromise blocking across endpoint, network, and web layers.