Detection and Response Engineer

The role

You will build systems to identify, investigate, and respond to threats across the platform. This engineering role focuses on automation, building detections, investigation tooling, and response capabilities using AI.

What you will do

• Design and build high-fidelity detections for attacks, abuse, and anomalous behavior
• Improve detections based on telemetry, threat intelligence, and lessons learned
• Improve visibility across cloud infrastructure, containers, identity systems, and production services
• Lead or participate in investigations spanning production infrastructure, cloud environments, and internal systems
• Build playbooks and automation to reduce investigation time
• Drive post-incident improvements to eliminate future incidents
• Build internal tooling to improve detection, investigation, and response workflows
• Leverage LLMs to automate analysis and surface insights from security telemetry
• Improve the collection, quality, and usability of security telemetry
• Partner with engineering teams to ensure systems are observable and secure by default

Required qualifications

• Experience in detection engineering, incident response, security engineering, or software engineering with a strong security focus
• Strong software engineering skills and experience building production systems
• Experience investigating security incidents in cloud-native or distributed environments
• Familiarity with modern cloud infrastructure, Kubernetes, Linux, and networking
• Experience building detections using logs, telemetry, behavioral signals, or large-scale event data
• Strong SQL skills for investigating security events and developing detections
• Interest in applying AI and LLMs to detection, investigation, and response
• Strong written and verbal communication skills

Nice to have

• Experience building AI- or LLM-powered security tooling
• Experience with SIEM, SOAR, or EDR platforms
• Experience with Kubernetes security or large-scale cloud infrastructure
• Experience with threat hunting, malware analysis, or digital forensics
• Experience contributing to security operations in a high-growth engineering organization

About the company

Modal is building a new infrastructure layer for AI. Their customers include companies like Ramp, Cognition, DoorDash, and Suno.