Staff Detection Engineer

How We Operate

• Be a barrel. Full autonomy. Own things end to end, take on scope without being asked, no permission required to operate outside your core role.
• Insane urgency. We drive everything forward as fast as possible.
• Reason from first principles. Challenge every assumption. Zero analogy thinking, no egos, the best idea wins.
• Love of the game. The frontier of AI is the most interesting problem of our time. We put in long hours at high intensity to push the frontier forward.
• Build something that actually matters. If you're going to spend your time, spend it on something that matters to the world.

The Security & Corp IT Team

The Security & Corp IT team protects the people, systems, and infrastructure behind the largest AI compute buildout in history.

• Build detection and response coverage across cloud (AWS/GCP/Azure), endpoint, and identity telemetry for a company whose attack surface spans corporate IT and gigawatt-scale data center infrastructure.
• Run incident response end to end, from first alert through containment, remediation, and postmortem, without a large SOC to fall back on.
• Stand up detection-as-code pipelines so every detection is versioned, tested, and deployed like software rather than hand-edited in a console.
• Harden corp IT foundations (identity, device management, access) so security scales with headcount instead of lagging it.

Role Scope

• Build the detection engineering function from the ground up: telemetry pipelines, detection content, alert routing, and response runbooks, with coverage you can defend against a threat model, not just a tool checklist.
• Own detection-as-code end to end, writing detections across cloud and endpoint sources with tests, version control, and CI so a bad rule never ships silently.
• Lead incident response for high-severity events, driving containment and root cause, and closing out each incident with detections that catch the same class of attack next time.
• Drive automation of triage and enrichment in Python (or similar) so alert volume scales without proportional headcount.
• Partner directly with leadership on security strategy, translating threat landscape and detection gaps into a prioritized roadmap with clear tradeoffs.
• Work across corp IT and infrastructure teams to get the telemetry, logging, and access you need, and to fix the root causes your detections keep surfacing.

What We're Looking For

• 8+ years in security operations, detection engineering, or incident response, with time spent at a high-growth tech company, cloud-native infrastructure provider, or top-tier MDR/threat intel firm.
• You've built or scaled a detection engineering function, not just operated inside one: you can point to the program, the pipeline, and the coverage that exist because of you.
• Deep hands-on experience writing detections against cloud telemetry (AWS, GCP, or Azure control plane and audit logs) and endpoint telemetry (EDR event streams, OS-level signals).
• Strong scripting and automation skills in Python or similar, enough to build and maintain detection-as-code pipelines yourself rather than spec them for someone else.
• Incident response experience at a company operating at significant scale, where you led response under pressure and your postmortems changed how the company operates.
• You operate as a technical lead without heavy management overhead: you set direction, make the calls, and do the work.
• You work well across corp IT and infrastructure teams in a fast-moving environment, and you get telemetry and fixes shipped by making the case, not by escalating.
• Bonus: experience securing GPU clusters, HPC environments, or physical data center infrastructure, or contributions to open-source detection content (Sigma, community rule sets).

We are committed to pay equity and transparency.