Detection & Response Engineer

The role

You will own the detection and response program to find and stop attacks against infrastructure, research environments, and products. You will build detections as code, automate responses, and lead incident investigations.

What you will do

• Own detection and response end to end
• Write and tune detections as code across cloud, Kubernetes, identity systems, endpoints and SaaS
• Lead incident response from first alert through containment and forensics
• Build automation for triage, enrichment, correlation, containment and evidence collection
• Monitor AI agents and developer tooling
• Partner with platform and research engineers for logging and response playbooks
• Run threat hunts and tabletop exercises
• Turn incident and detection metrics into evidence for SOC 2 and ISO 27001
• Participate in an on-call rotation for security incidents

Required qualifications

• Hands-on incident response experience
• Experience building and tuning detections in a modern SIEM
• Working knowledge of how attackers move through cloud and Kubernetes environments
• Comfort writing Python, Typescript, Rust or another language
• Familiarity with at least one major cloud platform
• Familiarity with Kubernetes at the level of audit logs, RBAC and workload identity
• Clear writing

Nice to have

• Experience monitoring GPU or HPC-style infrastructure, or research environments with large datasets
• Experience building detections or guardrails for AI agents, LLM tooling or MCP servers
• Cloud forensics experience
• Published open source detection content

About the company

Runway is building AI to simulate the world through merging art and science. The team consists of creative, open minded, caring and ambitious people.