Staff / Principal Software Engineer, Detection and Response

The role

You will build detection and response capabilities across corporate, production, and AI-agent surfaces. You will design the detection engineering platform and lead security incident response processes.

What you will do

• Build the detection engineering platform including pipelines, detections-as-code, automated triage, and response playbooks.
• Design and own security incident response process with 24/7 coverage.
• Lead incidents end-to-end from detection to post-mortem.
• Hunt proactively across corporate, production, and AI-agent surfaces.
• Turn findings into durable detections.
• Define and build world-class D&R for an AI-native company.

Required qualifications

• 8+ years in detection engineering, incident response, or threat hunting, with at least 3 at staff/principal level.
• Strong engineering background building detections as code.
• Deep experience with cloud telemetry (GCP/AWS/Cloudflare), endpoint EDR, identity logs, and modern SIEM/data-lake stacks (Panther, Elastic, Snowflake/Clickhouse).
• Battle-tested incident commander who has led real high-severity incidents from first alert to public post-mortem.
• Comfortable with MITRE ATT&CK, threat intel, purple-teaming, and red team collaboration.

Nice to have

• detection for LLM/agent abuse
• prompt injection at scale
• insider risk in AI-augmented engineering orgs

About the company

Lovable is a software creation platform that allows people to act on problems. It is a generational company based in Stockholm with teams in London, Boston, New York, and San Francisco.