Senior Detection and Response Engineer

San Francisco · 6+ years experience · Full-time · Posted Oct 2, 2026

At a glance

Anyscale is looking for a Senior Detection and Response Engineer to own detection engineering and lead incident response across production and corporate environments.
This is a high-ownership role reporting to the Head of Security, partnering with engineering, and shaping how detection and response works at the company.

Own and build detection coverage across cloud, endpoint, and runtime telemetry.
Own a centralized correlation and alerting capability that turns telemetry into actionable detections.
Own incident response: runbooks, escalation paths, and coordination during an incident, across corporate and production environments.
Drive detection of anomalous activity across the environments we run, including our Kubernetes footprint.
Tune detections to keep signal high and noise low, and measure detection and response performance such as mean time to detect and respond.
Run incident retrospectives and feed lessons back into detections and controls.
Partner with infrastructure security and IT to close gaps surfaced during response.

6+ years in security, with a strong focus on detection engineering and incident response, ideally at a high-growth startup.
Hands-on experience building detections and correlation across cloud (AWS, Azure), endpoint (EDR), and ideally container and runtime telemetry.
Experience owning incident response end to end, including leading during live incidents.
Comfort building and scaling a detection and response capability, not only operating an existing one.
Sound judgment under pressure and clear communication during incidents.
Fluency working with engineers and IT to close the gaps that response surfaces.