runway-ml - Detection & Response Engineer
Requirements
• Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward • Experience building and tuning detections in a modern SIEM, ideally managed as code • Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs • Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools • Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity • Clear writing. Incident timelines, detection documentation and updates to leadership are all part of the job • Judgment about what to alert on, what to automate and when to wake someone up • Experience monitoring GPU or HPC-style infrastructure, or research environments with large datasets • Experience building detections or guardrails for AI agents, LLM tooling or MCP servers • Cloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custody • Published open source detection content • Runway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide. • There are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range. • Lastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates. • WORKING AT RUNWAY • Great things come from great teams. https://www.youtube.com/watch?v=kwmj4ato2kw&ab_channel=Runway We’d love to hear from you. • We’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply.
Responsibilities
• Own detection and response end to end: what we log, what we alert on, how we triage and how we recover • Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume • Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read • Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit • Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls • Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one • Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find • Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team • Participate in an on-call rotation for security incidents
Benefits
• Upload your resume here to autofill key application fields. • Drop your resume here! • Parsing your resume. Autofilling key fields... • or drag and drop here • Do you agree to allow Runway retain your data to contact you about job opportunities for up to 4 years? • Note: The consent period lasts for 4 years • Recruiting Privacy Policy
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT