Threat Detection and Response Engineering Manager

OpenAI•San Francisco, CA

1d•$401,000 - $510,000

About The Position

OpenAI is seeking a hands-on technical leader to manage the engineers who identify and investigate threats and build capabilities to contain them. The role sets technical direction, prioritizes risks to OpenAI’s intellectual property, customer data, and critical infrastructure, and hires and develops engineers. The team will take an agent-first approach across the detection and response lifecycle, using OpenAI models to develop detections, triage signals, investigate suspicious activity, and support bounded response and continuous improvement. The manager owns the effectiveness of these defenses, establishes where agents may act independently and where human approval is essential, and partners with security, research, and infrastructure teams to turn findings into effective action. The role includes building threat-informed detection and investigation workflows, developing and testing response and containment controls, applying models throughout the detection engineering lifecycle, and evaluating model-enabled workflows against realistic adversary behavior and analyst baselines. It also entails identifying emerging threats, improving telemetry and forensic visibility, engineering measurable security outcomes through testing and operational practices, and contributing investigative expertise during incidents. The Security Incident Response Team (SIRT) leads formal incident response.

Requirements

Experience managing security or software engineers, including hiring, coaching, developing technical judgment, and improving team delivery.
Hands-on ability to prototype tools, write and review code, and guide complex detection, investigation, and response designs.
Strong AI fluency and experience building systems that test how models or agents can improve cyber defense.
Experience evaluating real security workflows against meaningful baselines and explaining what improved, what failed, and what changed.
Understanding of model failure modes and how to design reliable workflows with bounded permissions and clear human decision points.
Experience building or operating threat detections and leading technical investigations.
Understanding of adversary tradecraft and ability to assess evidence, scope, and uncertainty across complex environments.
Understanding of how identity, endpoint, cloud, Kubernetes, and infrastructure telemetry supports investigations.
Ability to reason about response and containment in unfamiliar systems and work with system owners to build practical capabilities.
Experience using testing and operational feedback to improve security outcomes.
Ability to weigh coverage, accuracy, speed, and human workload and select measures that reflect whether threats are found and addressed.
Ability to build a focused roadmap and strong cross-functional partnerships in a rapidly changing environment.

Responsibilities

Hire, coach, and develop engineers; set expectations, provide feedback, grow technical leadership, and foster rigorous reviews and learning from missed detections and noisy signals.
Set a threat-informed roadmap that prioritizes detection work across model-training and evaluation systems, production services, datacenter hardware and networks, and employee devices, identities, and applications.
Own detection and investigation workflows, including agent-driven triage and investigation, surfacing evidence-backed findings, and supporting investigations led by SIRT.
Work with infrastructure and system owners to develop and test response and containment controls; define human-approval requirements and verify containment effectiveness.
Apply OpenAI models to develop threat hypotheses, author and test detections, deploy and tune them, and use investigation findings to improve coverage.
Evaluate the effectiveness of individual agents and the complete workflows they support.
Prototype model-based defense approaches, test them against realistic adversary behavior and analyst baselines, and move successful experiments into production.
Use operational evidence to identify model limitations and partner with Research and Engineering to address them.
Translate adversary intelligence and incident findings into testable detection hypotheses, including risks specific to a frontier AI lab.
Partner with Security Observability and infrastructure owners to define telemetry and forensic data requirements and improve visibility and controls.
Use replay, adversarial validation, and regression testing to assess threat detection, benign-activity discrimination, and defensible conclusions.
Establish code review, documentation, staged rollout, monitoring, and rollback practices.
Measure coverage, investigation accuracy, time to identify threats, and response effectiveness.
Contribute investigative expertise during incidents and use incident findings to improve detections.