Senior Security Engineer - Detection & Response

Join Lambda’s Detection & Response team and help build the capabilities that keep security operations resilient, proactive, and fast. This role combines hands-on detection engineering with incident response leadership, including 24/7 operational readiness. You will work across multi-cloud and bare-metal environments, partnering with platform and infrastructure teams to strengthen telemetry and automate response workflows that reduce time-to-detect and time-to-respond.

Location: San Jose, CA (onsite, 4 days per week). Lambda’s designated work from home day is currently Tuesday. Reporting structure: you’ll work with the Security Engineering Lead.

Compensation: USD 266,000 - 395,000 per year. Health benefits include coverage for you and your dependents, plus generous cash & equity compensation.

What you’ll do

• Design, build, and maintain robust detection rules, signatures, and behavioral analytics across Lambda’s cloud, bare-metal, and internal infrastructure.
• Run proactive threat hunting to identify hidden threat actors, novel attack vectors, and zero-day vulnerabilities across multi-cloud and AI workloads.
• Develop custom detection logic and playbooks as code to reduce manual triage toil and improve detection and response speed.
• Pioneer AI-powered detection and investigation workflows using Lambda’s internal LLM infrastructure to automate log analysis and enrich threat intelligence context.
• Lead technical incident response investigations, including deep-dive forensics, root-cause identification, and containment for complex events.
• Architect automated response and orchestration (SOAR) pipelines to isolate compromised assets and revoke compromised credentials programmatically.
• Partner with Platform and Infrastructure engineering to harden systems, build security instrumentation, and ensure strong telemetry coverage.
• Participate in an engineering on-call rotation to maintain 24/7 operational readiness and rapid containment.
• Conduct post-incident reviews to capture technical learnings, drive root-cause remediation, and prevent recurrence.
• Mentor junior and mid-level security engineers by sharing detection engineering expertise and promoting best practices in automation.

What you bring

• 5+ years of hands-on security engineering experience focused on detection engineering, threat hunting, or DFIR.
• Strong programming and scripting skills (examples: Python, Go, Rust, Bash) with a history of building automated security tools and pipelines.
• Deep knowledge of cloud infrastructure security (including AWS/GCP), Linux system internals, container runtime security, and network telemetry.
• Clear understanding of the unique requirements of securing a cloud infrastructure provider.
• Experience writing detection rules and managing detections through software development best practices (examples: SIEM, YARA, Sigma, Falco, EDR queries).
• Hands-on experience performing forensic investigations and triaging complex, multi-stage attacks across cloud environments.
• Strong technical communication skills for documenting vulnerabilities, incident post-mortems, and architectural designs.
• Ability to operate in high-ambiguity environments, building structure while moving at startup pace.

Tools and technologies

• Python, Go, Rust, Bash
• AWS, GCP
• Linux, container runtime security
• Network telemetry
• SIEM, YARA, Sigma, Falco, EDR queries
• SOAR, LLM

Benefits

• Health, dental, and vision coverage for you and your dependents.
• Wellness and commuter stipends for select roles.
• 401k Plan with 2% company match (USA employees).
• Flexible paid time off plan that the team actually uses.
• Generous cash & equity compensation.

Nice to have

• Interest in leveraging direct access to state-of-the-art LLMs for security operations, including AI-powered threat hunting, automated security report generation, and vulnerability prioritization at scale.
• Experience building detection and response programs at AI/ML companies.
• Track record using AI/ML for security operations automation.
• Experience scaling security during hypergrowth (10x growth phases).
• Experience with eBPF, kernel-level telemetry, or specialized bare-metal host security tools.
• Experience with both build and buy decisions for security tooling.
• Experience driving or providing evidence for compliance audits, such as SOC 2, ISO 27001, PCI-DSS, HIPAA/HITECH, or FedRAMP.