Senior/Staff Engineer, Detection & Response
for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes "About the team" (maybe treat as About the role). It includes responsibilities list (What you’ll be doing). It includes "Who you are" (requirements/qualifications/skills). It includes "What’s In It For You" and then "Benefits & Perks". No explicit Pay or Schedule except note: "Please note, this role is 5 days/week on-site in Manhattan, NYC (Union Square)". That's schedule info: 5 days/week on-site. So we can include Schedule section with that detail. Pay: Not mentioned (competitive package but no numbers). So we should not include Pay section because no specific pay. Benefits: we have Benefits & Perks details. So include Benefits section.
We need to avoid repeating job title as heading. No Job ID.
We need to use - for any list of duties/requirements/benefits. Use
for prose.
We must preserve all substantive information, not invent or summarize away detail. Remove boilerplate etc.
We need to include sections only when posting has real specific content.
Thus sections: About the role (maybe from "About the team" and description). Responsibilities (What you’ll be doing). Requirements (Who you are). Skills (maybe combine with requirements? Could separate but we need to avoid thin sections. The posting includes "Strong software engineering skills..." etc. That's qualifications/skills. Could put under Requirements or Skills. Since we have both Requirements and Skills possible headings, but we should prefer few substantive sections over many thin ones. Could combine into one section "Requirements" covering both experience and skills. But the instruction says use headings for those categories if content exists. However we can decide to include only those that have substantive content. The posting has distinct "Who you are" which includes experience, skills, nice to have. Could treat as Requirements. Could also have Skills section for technical skills. But to avoid thin sections, maybe combine into one "Requirements" that includes both experience and skills. However the instruction: "Prefer a few substantive sections over many thin ones." So we can combine.
Thus sections: About the role, Responsibilities, Requirements, Benefits, Schedule.
We need to format.
About the role: prose from "About the team" paragraph plus maybe the mission description. Let's capture: "The IT and AI Enablement function helps Legora run securely and reliably as we grow. We are building an AI-native Information Security function. We ship security controls as software, and agents handle first-pass triage and routine investigation. People make the high-impact calls." That's about the team. Also maybe include the role ownership description? But that belongs to responsibilities. So About the role: that paragraph.
Responsibilities: list of duties from "What you’ll be doing" bullet points (though not bullet but sentences). We need to convert to
- . We'll extract each sentence as a list item.
Let's list them:
- Own detection and response across endpoints, identity, cloud workloads, SaaS, and Legora's AI systems.
- Hunt, triage, investigate, contain, and drive incidents through resolution, then turn what you learn into better detections and controls.
- Build detections as production software on telemetry and pipelines provided by AI & Integrations Engineering. Keep them version-controlled, peer-reviewed, tested, and deployed through CI/CD.
- Measure coverage, precision, and time to detection, then tune where the data shows a gap.
- Build threat models, telemetry, and response playbooks for our AI systems, agents, and their tool use. Detect misuse of agents operating across the company.
- Build and supervise agents for triage, enrichment, and investigation. Set guardrails and approval thresholds for containment and other high-impact actions.
- Map coverage to MITRE ATT&CK and validate it through threat hunting, penetration-test findings, and adversary emulation.
- Share the on-call rotation and act as incident commander when security is involved. Engineering owns service reliability; Customer Trust and Legal own customer communications. Run post-incident reviews and use the findings to reduce detection and containment time.
- Investigate insider risk and identity abuse with Corporate Security, People, and Legal. Work with Vulnerability Management on exposure priorities and IT Systems on the underlying estate.
- Track actors and campaigns targeting AI companies and convert the intelligence into hunts and detections. Own the digital-risk platform and coordinate urgent phishing and impersonation takedowns.
That's many items; okay.
Requirements: from "Who you are" plus maybe "Nice to have". We'll separate required vs nice? Could include both but maybe separate sections? But we want few sections. Could include Requirements with required and nice-to-have as sublist? But we need to use
- for any list. Could have two lists: Required and Nice to have, each as
. But that would be under same heading? Could have Requirements
then Required:
... then Nice to have:
. That's okay.
Let's extract required:
- 5+ years in detection engineering, incident response, or security operations, including work as a senior escalation point. For Staff, we expect roughly 10+ years and experience setting detection and response strategy.
- Strong software engineering skills in Python and SQL. You build detections, automations, and telemetry pipelines that run reliably in production.
- You use LLMs and agents in day-to-day security work and know which decisions require a human. Be ready to show us an investigation or workflow you automated.
- Fluent across endpoint, identity, cloud, and SaaS telemetry. You reason from attacker behaviour and correlate signals across systems.
- You communicate clearly during incidents and turn incomplete technical evidence into sound decisions. Your post-incident reviews lead to concrete changes.
Nice to have:
- Experience with a modern SIEM or security data lake and at least two relevant query or rule languages, such as SPL, KQL, YARA-L, Sigma, or SQL.
- Experience securing AI systems, agent tool use, and AI data flows, including prompt injection and exfiltration risks.
- Experience with response automation, incident management, digital forensics, or malware analysis.
- Threat intelligence, insider risk, or DLP experience.
Benefits: from "What’s In It For You" and "Benefits & Perks". We need to capture substantive benefits.
What’s In It For You bullet points:
- Global collaboration: Partner with teams and clients across Europe, APAC, and North America.
- Competitive package: Comprehensive salary, benefits, and tools for success.
- Meaningful work: Your efforts shape how thousands of lawyers use AI daily.
- In-person environment: Union Square office designed for ambitious builders and company provided lunch daily.
Then Benefits & Perks list:
- Medical, Dental & Vision
- Multiple medical plan options through Aetna and Kaiser Permanente
- HSA or Healthcare FSA (based on plan selection)
- Dental plans via MetLife
- Vision plans via Vision Care
- Family Support
- Generous parental leave
- Free access to Maven Clinic
- Dependent Care FSA
- Free One Medical membership for employees and dependents
- Additional Perks
- Pre-tax commuter benefits
- Life Insurance + STD/LTD
- 401(K) with generous company match
- Unlimited PTO
- Robust voluntary benefits, including identity protection (via Aura), legal coverage via MetLife, pet savings programs, and more
We need to output as list items.
Schedule: from note: "Please note, this role is 5 days/week on-site in Manhattan, NYC (Union Square)". So schedule: 5 days/week on-site in Manhattan, NYC (Union Square). We'll put in Schedule section.
Now produce HTML fragment.
We must not include markdown code fences. Just raw HTML.
Let's craft.
About the role
The IT and AI Enablement function helps Legora run securely and reliably as we grow. We are building an AI-native Information Security function. We ship security controls as software, and agents handle first-pass triage and routine investigation. People make the high-impact calls.
Responsibilities
- Own detection and response across endpoints, identity, cloud workloads, SaaS, and Legora's AI systems.
- Hunt, triage, investigate, contain, and drive incidents through resolution, then turn what you learn into better detections and controls.
- Build detections as production software on telemetry and pipelines provided by AI & Integrations Engineering. Keep them version-controlled, peer-reviewed, tested, and deployed through CI/CD.
- Measure coverage, precision, and time to detection, then tune where the data shows a gap.
- Build threat models, telemetry, and response playbooks for our AI systems, agents, and their tool use. Detect misuse of agents operating across the company.
- Build and supervise agents for triage, enrichment, and investigation. Set guardrails and approval thresholds for containment and other high-impact actions.
- Map coverage to MITRE ATT&CK and validate it through threat hunting, penetration-test findings, and adversary emulation.
- Share the on-call rotation and act as incident commander when security is involved. Engineering owns service reliability; Customer Trust and Legal own customer communications. Run post-incident reviews and use the findings to reduce detection and containment time.
- Investigate insider risk and identity abuse with Corporate Security, People, and Legal. Work with Vulnerability Management on exposure priorities and IT Systems on the underlying estate.
- Track actors and campaigns targeting AI companies and convert the intelligence into hunts and detections. Own the digital-risk platform and coordinate urgent phishing and impersonation takedowns.
Requirements
Required:
- 5+ years in detection engineering, incident response, or security operations, including work as a senior escalation point. For Staff, we expect roughly 10+ years and experience setting detection and response strategy.
- Strong software engineering skills in Python and SQL. You build detections, automations, and telemetry pipelines that run reliably in production.
- You use LLMs and agents in day-to-day security work and know which decisions require a human. Be ready to show us an investigation or workflow you automated.
- Fluent across endpoint, identity, cloud, and SaaS telemetry. You reason from attacker behaviour and correlate signals across systems.
- You communicate clearly during incidents and turn incomplete technical evidence into sound decisions. Your post-incident reviews lead to concrete changes.
Nice to have:
- Experience with a modern SIEM or security data lake and at least two relevant query or rule languages, such as SPL, KQL, YARA-L, Sigma, or SQL.
- Experience securing AI systems, agent tool use, and AI data flows, including prompt injection and exfiltration risks.
- Experience with response automation, incident management, digital forensics, or malware analysis.
- Threat intelligence, insider risk, or DLP experience.
Benefits
- Global collaboration: Partner with teams and clients across Europe, APAC, and North America.
- Competitive package: Comprehensive salary, benefits, and tools for success.
- Meaningful work: Your efforts shape how thousands of lawyers use AI daily.
- In-person environment: Union Square office designed for ambitious builders and company provided lunch daily.
- Medical, Dental & Vision
- Multiple medical plan options through Aetna and Kaiser Permanente
- HSA or Healthcare F
for prose. We must preserve all substantive information, not invent or summarize away detail. Remove boilerplate etc. We need to include sections only when posting has real specific content. Thus sections: About the role (maybe from "About the team" and description). Responsibilities (What you’ll be doing). Requirements (Who you are). Skills (maybe combine with requirements? Could separate but we need to avoid thin sections. The posting includes "Strong software engineering skills..." etc. That's qualifications/skills. Could put under Requirements or Skills. Since we have both Requirements and Skills possible headings, but we should prefer few substantive sections over many thin ones. Could combine into one section "Requirements" covering both experience and skills. But the instruction says use headings for those categories if content exists. However we can decide to include only those that have substantive content. The posting has distinct "Who you are" which includes experience, skills, nice to have. Could treat as Requirements. Could also have Skills section for technical skills. But to avoid thin sections, maybe combine into one "Requirements" that includes both experience and skills. However the instruction: "Prefer a few substantive sections over many thin ones." So we can combine. Thus sections: About the role, Responsibilities, Requirements, Benefits, Schedule. We need to format. About the role: prose from "About the team" paragraph plus maybe the mission description. Let's capture: "The IT and AI Enablement function helps Legora run securely and reliably as we grow. We are building an AI-native Information Security function. We ship security controls as software, and agents handle first-pass triage and routine investigation. People make the high-impact calls." That's about the team. Also maybe include the role ownership description? But that belongs to responsibilities. So About the role: that paragraph. Responsibilities: list of duties from "What you’ll be doing" bullet points (though not bullet but sentences). We need to convert to
- . We'll extract each sentence as a list item.
Let's list them:
- Own detection and response across endpoints, identity, cloud workloads, SaaS, and Legora's AI systems.
- Hunt, triage, investigate, contain, and drive incidents through resolution, then turn what you learn into better detections and controls.
- Build detections as production software on telemetry and pipelines provided by AI & Integrations Engineering. Keep them version-controlled, peer-reviewed, tested, and deployed through CI/CD.
- Measure coverage, precision, and time to detection, then tune where the data shows a gap.
- Build threat models, telemetry, and response playbooks for our AI systems, agents, and their tool use. Detect misuse of agents operating across the company.
- Build and supervise agents for triage, enrichment, and investigation. Set guardrails and approval thresholds for containment and other high-impact actions.
- Map coverage to MITRE ATT&CK and validate it through threat hunting, penetration-test findings, and adversary emulation.
- Share the on-call rotation and act as incident commander when security is involved. Engineering owns service reliability; Customer Trust and Legal own customer communications. Run post-incident reviews and use the findings to reduce detection and containment time.
- Investigate insider risk and identity abuse with Corporate Security, People, and Legal. Work with Vulnerability Management on exposure priorities and IT Systems on the underlying estate.
- Track actors and campaigns targeting AI companies and convert the intelligence into hunts and detections. Own the digital-risk platform and coordinate urgent phishing and impersonation takedowns.
That's many items; okay.
Requirements: from "Who you are" plus maybe "Nice to have". We'll separate required vs nice? Could include both but maybe separate sections? But we want few sections. Could include Requirements with required and nice-to-have as sublist? But we need to use
- for any list. Could have two lists: Required and Nice to have, each as
- . But that would be under same heading? Could have
- Own detection and response across endpoints, identity, cloud workloads, SaaS, and Legora's AI systems.
- Hunt, triage, investigate, contain, and drive incidents through resolution, then turn what you learn into better detections and controls.
- Build detections as production software on telemetry and pipelines provided by AI & Integrations Engineering. Keep them version-controlled, peer-reviewed, tested, and deployed through CI/CD.
- Measure coverage, precision, and time to detection, then tune where the data shows a gap.
- Build threat models, telemetry, and response playbooks for our AI systems, agents, and their tool use. Detect misuse of agents operating across the company.
- Build and supervise agents for triage, enrichment, and investigation. Set guardrails and approval thresholds for containment and other high-impact actions.
- Map coverage to MITRE ATT&CK and validate it through threat hunting, penetration-test findings, and adversary emulation.
- Share the on-call rotation and act as incident commander when security is involved. Engineering owns service reliability; Customer Trust and Legal own customer communications. Run post-incident reviews and use the findings to reduce detection and containment time.
- Investigate insider risk and identity abuse with Corporate Security, People, and Legal. Work with Vulnerability Management on exposure priorities and IT Systems on the underlying estate.
- Track actors and campaigns targeting AI companies and convert the intelligence into hunts and detections. Own the digital-risk platform and coordinate urgent phishing and impersonation takedowns.
- 5+ years in detection engineering, incident response, or security operations, including work as a senior escalation point. For Staff, we expect roughly 10+ years and experience setting detection and response strategy.
- Strong software engineering skills in Python and SQL. You build detections, automations, and telemetry pipelines that run reliably in production.
- You use LLMs and agents in day-to-day security work and know which decisions require a human. Be ready to show us an investigation or workflow you automated.
- Fluent across endpoint, identity, cloud, and SaaS telemetry. You reason from attacker behaviour and correlate signals across systems.
- You communicate clearly during incidents and turn incomplete technical evidence into sound decisions. Your post-incident reviews lead to concrete changes.
- Experience with a modern SIEM or security data lake and at least two relevant query or rule languages, such as SPL, KQL, YARA-L, Sigma, or SQL.
- Experience securing AI systems, agent tool use, and AI data flows, including prompt injection and exfiltration risks.
- Experience with response automation, incident management, digital forensics, or malware analysis.
- Threat intelligence, insider risk, or DLP experience.
- Global collaboration: Partner with teams and clients across Europe, APAC, and North America.
- Competitive package: Comprehensive salary, benefits, and tools for success.
- Meaningful work: Your efforts shape how thousands of lawyers use AI daily.
- In-person environment: Union Square office designed for ambitious builders and company provided lunch daily.
- Medical, Dental & Vision
- Multiple medical plan options through Aetna and Kaiser Permanente
- HSA or Healthcare F
Requirements
thenRequired:
- ... then
Nice to have:
- . That's okay.
Let's extract required:
- 5+ years in detection engineering, incident response, or security operations, including work as a senior escalation point. For Staff, we expect roughly 10+ years and experience setting detection and response strategy.
- Strong software engineering skills in Python and SQL. You build detections, automations, and telemetry pipelines that run reliably in production.
- You use LLMs and agents in day-to-day security work and know which decisions require a human. Be ready to show us an investigation or workflow you automated.
- Fluent across endpoint, identity, cloud, and SaaS telemetry. You reason from attacker behaviour and correlate signals across systems.
- You communicate clearly during incidents and turn incomplete technical evidence into sound decisions. Your post-incident reviews lead to concrete changes.
Nice to have:
- Experience with a modern SIEM or security data lake and at least two relevant query or rule languages, such as SPL, KQL, YARA-L, Sigma, or SQL.
- Experience securing AI systems, agent tool use, and AI data flows, including prompt injection and exfiltration risks.
- Experience with response automation, incident management, digital forensics, or malware analysis.
- Threat intelligence, insider risk, or DLP experience.
Benefits: from "What’s In It For You" and "Benefits & Perks". We need to capture substantive benefits.
What’s In It For You bullet points:
- Global collaboration: Partner with teams and clients across Europe, APAC, and North America.
- Competitive package: Comprehensive salary, benefits, and tools for success.
- Meaningful work: Your efforts shape how thousands of lawyers use AI daily.
- In-person environment: Union Square office designed for ambitious builders and company provided lunch daily.
Then Benefits & Perks list:
- Medical, Dental & Vision
- Multiple medical plan options through Aetna and Kaiser Permanente
- HSA or Healthcare FSA (based on plan selection)
- Dental plans via MetLife
- Vision plans via Vision Care
- Family Support
- Generous parental leave
- Free access to Maven Clinic
- Dependent Care FSA
- Free One Medical membership for employees and dependents
- Additional Perks
- Pre-tax commuter benefits
- Life Insurance + STD/LTD
- 401(K) with generous company match
- Unlimited PTO
- Robust voluntary benefits, including identity protection (via Aura), legal coverage via MetLife, pet savings programs, and more
We need to output as list items.
Schedule: from note: "Please note, this role is 5 days/week on-site in Manhattan, NYC (Union Square)". So schedule: 5 days/week on-site in Manhattan, NYC (Union Square). We'll put in Schedule section.
Now produce HTML fragment.
We must not include markdown code fences. Just raw HTML.
Let's craft.
About the role
The IT and AI Enablement function helps Legora run securely and reliably as we grow. We are building an AI-native Information Security function. We ship security controls as software, and agents handle first-pass triage and routine investigation. People make the high-impact calls.
Responsibilities
Requirements
Required:
Nice to have:
Benefits
- for any list. Could have two lists: Required and Nice to have, each as