Senior Security Engineer - Detection & Response

Build proactive security capabilities on Lambda’s Detection & Response team. In this hands-on role, you’ll design and automate detection engineering, threat hunting, and incident response across multi-cloud and bare-metal infrastructure, helping shift security operations from reactive handling to proactive threat management with 24/7 operational resilience. You’ll report to the Security Engineering Lead and partner closely with Platform and Infrastructure teams to strengthen telemetry and response at scale.

What you’ll do

• Design, build, and maintain detection rules, signatures, and behavioral analytics across Lambda’s cloud, bare-metal, and internal infrastructure
• Run proactive threat hunting to uncover hidden threat actors, novel attack vectors, and zero-day vulnerabilities across multi-cloud and AI workloads
• Create custom detection logic and playbooks as code to reduce manual triage toil and improve time-to-detect and time-to-respond
• Pioneer AI-powered detection and investigation workflows using Lambda’s internal LLM infrastructure to automate log analysis and add threat intelligence context
• Lead technical incident response investigations for complex events, including deep-dive forensics, root-cause identification, and containment
• Architect automated response capabilities and SOAR orchestration pipelines to programmatically isolate compromised assets and revoke compromised credentials
• Partner with Platform and Infrastructure engineering teams to harden systems, build security instrumentation, and ensure telemetry coverage across services
• Participate in an engineering on-call rotation to maintain 24/7 readiness and rapid incident containment
• Conduct post-incident reviews to extract technical learnings, drive remediation, and prevent recurring incidents
• Mentor junior and mid-level security engineers, sharing detection engineering and automation best practices

Requirements

• 5+ years of hands-on security engineering experience in detection engineering, threat hunting, or DFIR (digital forensics and incident response)
• Strong programming and scripting skills (examples: Python, Go, Rust, or Bash) with a track record of building automated security tools and pipelines
• Deep knowledge of cloud infrastructure security (AWS/GCP), Linux system internals, container runtime security, and network telemetry
• Clear understanding of the unique requirements of securing a cloud infrastructure provider
• Experience writing detection rules (examples: SIEM, YARA, Sigma, Falco, EDR queries) and managing detections using software development best practices
• Hands-on experience conducting forensic investigations and triaging complex, multi-stage attacks across cloud environments
• Strong technical communication skills to document vulnerabilities, incident post-mortems, and architectural designs clearly
• Comfort operating in high-ambiguity environments while building structure at startup pace

Technologies you may work with

Python, Go, Rust, Bash, AWS, GCP, Linux, container runtime security, network telemetry, SIEM, YARA, Sigma, Falco, EDR queries, SOAR, LLM

Compensation & benefits

• Salary range: USD 266,000 - 395,000 per year
• Health, dental, and vision coverage for you and your dependents
• Wellness and commuter stipends for select roles
• 401k plan: 2% company match for USA employees
• Flexible paid time off plan that the team actually uses
• Generous cash & equity compensation

Location and schedule

This role requires presence in the Bellevue, San Francisco, or San Jose office 4 days per week. Lambda’s designated work from home day is currently Tuesday.

Nice to have

• Excitement about leveraging direct access to state-of-the-art LLMs to transform security operations, including AI-powered threat hunting, automated security report generation, and intelligent vulnerability prioritization through self-hosted AI infrastructure
• Experience building Detection & Response programs at AI/ML companies
• Track record using AI/ML for security operations automation
• Background scaling security during hypergrowth (10x growth phases)
• Experience with eBPF, kernel-level telemetry, or specialized bare-metal host security tools
• Experience with both build and buy decisions for security tooling
• Experience driving or providing significant evidence for compliance audits such as SOC 2, ISO 27001, PCI-DSS, HIPAA/HITECH, or FedRAMP

Note: The annual salary range is based on market data and other factors. A higher or lower salary may be appropriate for candidates whose qualifications differ meaningfully from those listed.