Senior Security Engineer, Detection and Response

Position Summary

At HackerOne, we're rebuilding our Detection & Response function with an AI-first approach—focused on engineering, not just triage. As a Senior Security Engineer, you will design and deliver detection and response capabilities that protect a modern, cloud-native environment by writing code, building AI-powered tooling, and automating workflows end-to-end. This role operates across the full detection lifecycle—from identifying gaps in observability to shipping high-signal detections and leading incident response when it matters most. You'll help scale what a small team can accomplish by embedding automation, intelligence, and AI into how we detect and respond to threats.

What You Will Do

• Design, build, and maintain detection-as-code capabilities across cloud infrastructure, SaaS applications, endpoints, and identity systems, improving coverage and signal quality through Data-Driven Decision Making
• Build automated investigation and response workflows that replace manual runbooks, leveraging AI First principles to scale triage, enrichment, containment, and remediation
• Develop and deploy AI/LLM-powered tooling to accelerate investigations, reduce alert fatigue, and extend team capacity beyond traditional headcount constraints, embedding AI First practices into daily workflows
• Lead and participate in incident response, including detection, investigation, containment, and retrospectives, applying First Principles Problem Solving to identify root causes and improve long-term resilience
• Partner cross-functionally with engineering and platform teams to expand logging, improve observability, and embed detection capabilities into the development lifecycle
• Continuously improve detection quality by analyzing alert performance, tuning for signal, and building feedback loops between incidents and detections using Data-Driven Decision Making
• Proactively identify gaps in visibility or coverage and translate ambiguous problem spaces into concrete detection and response solutions through First Principles Problem Solving
• Adapt quickly to evolving threats, tools, and priorities, helping the team maintain momentum and effectiveness through Change Agility

Minimum Qualifications

• 5+ years of experience in detection and response, security engineering, or software engineering with a security focus
• Strong software engineering fundamentals with proficiency in Python, Go, Ruby, or similar languages, and experience working in production codebases
• Hands-on experience with cloud environments (AWS preferred), including services such as CloudTrail, GuardDuty, and VPC flow logs
• Experience with log aggregation and analysis platforms (e.g., Datadog, Splunk, ELK) and endpoint detection tools (e.g., SentinelOne, CrowdStrike)

Preferred Qualifications

• Experience building AI/LLM-powered security tooling or applying AI to detection, triage, or investigation workflows
• Experience with detection-as-code frameworks or building custom detection pipelines
• Familiarity with containerized environments (Docker, Kubernetes, ECS/EKS)
• Experience with threat intelligence, threat hunting, forensics, or attacker tradecraft frameworks such as MITRE ATT&CK

Job Benefits

• Health (medical, vision, dental), life, and disability insurance
• Equity stock options
• Retirement plans
• Paid public holidays and unlimited PTO
• Paid maternity and parental leave
• Leaves of absence (including caregiver leave and leave under CO's Healthy Families and Workplaces Act)
• Employee Assistance Program