Security Engineer Detection Response
Job Summary
The Security Engineer will lead the detection and response function by managing the SIEM platform and driving AI-augmented SOC tool adoption. You will architect security posture, handle incident response, and build automation to scale security operations. This role involves deep technical work within a security-conscious engineering culture at a large-scale mobile marketing platform.
Responsibilities
- Operate SIEM and alert pipelines
- Lead AI-augmented SOC integration
- Drive incident response and runbooks
- Develop security automation tooling
- Collaborate on cross-team security initiatives
Required Skills
- 5+ years security/detection engineering
- Production SIEM experience
- Automation coding skills
- Incident response expertise
- Strong technical documentation
Job Details
### Responsibilities:
- Own day-to-day operation of Liftoff's SIEM (Panther) — log source ingestion, detection content, and the alert investigation pipeline.
- Lead Liftoff's adoption of AI-augmented SOC tooling (e.g. Prophet, Dropzone, or equivalent) as a multi-year modernization investment.
- Triage incoming security alerts and drive timely investigation and remediation with stakeholders across Engineering and IT.
- Lead incident response — investigation, containment, and post-incident review — and mature processes and runbooks so response becomes predictable and repeatable.
- Build tooling and automation that detects active threats, enriches alerts, and reduces manual investigation toil.
- Partner with Engineering and IT to make detection and response self-service where possible — clear log-onboarding paths, documented detection proposals, accessible runbooks — so security scales without becoming a bottleneck.
- Close the feedback loop between the team's offensive and proactive findings and detection coverage.
- Partner across the security team on cloud, infrastructure, and application security work alongside your detection and response focus.
- Participate in the Security team's on-call rotation and incident response.
### Minimum Qualifications:
- 5+ years in security engineering, security operations, detection engineering, or software engineering with a security focus.
- Hands-on production SIEM operation — onboarding log sources, writing and maintaining detection content, and triaging alerts.
- Write production-quality code for security automation and detection-as-code.
- Experience leading or substantially contributing to security incident response.
- Strong technical writing — design docs, runbooks, and post-incident reviews.
- Demonstrated judgment in prioritizing security work using a risk-based approach.
- Ability to quickly navigate large, unfamiliar codebases and reason about complex engineering systems.
- Excellent verbal communication.
- Willing to participate in an on-call rotation.
### Desirable Qualifications:
- Hands-on experience with an AI-augmented SOC platform or with building large language model (LLM) augmented investigation and runbook tooling.
- Experience operating in cloud environments at scale.
- Cloud incident response experience, particularly in AWS.
- Endpoint forensics for incident response on Mac and/or Linux.
- Detection-as-code workflows in continuous integration and deployment (CI/CD) pipelines.
- Mobile adtech or high-volume SaaS background.