Detection & Response Engineer, Runway

• Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward
• Experience building and tuning detections in a modern SIEM, ideally managed as code
• Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs
• Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools
• Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity
• Clear writing. Incident timelines, detection documentation and updates to leadership are all part of the job
• Judgment about what to alert on, what to automate and when to wake someone up

Desirable

• Runway is hiring a Detection & Response Engineer to own how we find and stop attacks against our infrastructure, our research environment and our products
• Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product
• The environment includes research compute, large training datasets, a fast-moving build pipeline and engineers who work inside AI-assisted tooling every day
• Each of those changes what an attack looks like and what you need to see to catch it
• You'll join the Security team and build our detection and response program the way an engineer would: detections as code, response as automation, evidence as something you can query
• This is a role with real ownership: you'll own the detection program end to end, from what we log to how quickly we close an incident
• You'll report to the head of security, partner with engineers across platform and research, and shape how this function grows from here
• Own detection and response end to end: what we log, what we alert on, how we triage and how we recover
• Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume
• Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read
• Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit
• Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls
• Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one
• Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find
• Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team
• Participate in an on-call rotation for security incidents