Detection & Response Engineer

About the role

Runway‑ml is building AI world models and needs a Detection & Response Engineer to own how attacks are found and stopped across its research infrastructure, compute clusters, and AI‑driven products. The role reports to the Head of Security and works closely with platform and research engineers.

Key responsibilities

• Design, implement and tune detection rules as code across cloud, Kubernetes, identity, endpoint and SaaS environments.
• Lead incident response from alert triage through containment, forensics and post‑incident review.
• Automate triage, enrichment, correlation and evidence collection using scripting and LLM‑based tooling.
• Partner with engineering teams to embed logging and response playbooks into new services from day one.
• Conduct threat hunts, tabletop exercises and translate findings into SOC 2, ISO 27001 evidence.

Required profile

• Hands‑on incident response experience with live alerts and investigations.
• Experience building detections in a modern SIEM, preferably managed as code.
• Deep understanding of attacker techniques in cloud and Kubernetes environments.
• Strong written communication for incident timelines and leadership updates.

Required skills

• Python, Typescript or Rust for automation.
• Knowledge of at least one major cloud platform (AWS, GCP or Azure).
• Kubernetes audit logs, RBAC and workload identity.
• SIEM configuration and detection rule development.