Security Engineer, Detection & Response

Why Now

Brain Co. is entering its next phase of production deployments on a national scale with an elite team built from Palantir, Google, Meta, and Nvidia, and a growing footprint across government, insurance, health, and financial services.

Joining now means shaping both the company and a new category of applied AI. Every project here ships to production and is expected to create measurable customer value and impact.

You'll work alongside exceptional peers on some of the hardest problems in applied AI. It’s the kind of work you'll still be proud of in ten years from now.

About the Role

We are looking for a Security Engineer, Detection & Response to build and operate our detection and response capabilities as Brain Co. expands. Reporting directly to the Head of Security, you will partner closely with engineering, infrastructure, infrastructure security, IT, and operational teams to protect our environments and respond effectively to security incidents.

This is an engineering-focused builder role rather than a passive alert-monitoring position. You will strengthen our security posture from the ground up: designing high-signal detections, automating triage and investigation workflows, leading cross-functional incident response, and converting incident findings into safer engineering defaults across the company.

The program is early enough that your judgment will shape the tooling, workflows, metrics, and operating model-not just the alerts you investigate. You will have significant autonomy to improve signal quality, streamline integrations, and turn incident lessons into stronger engineering defaults across the organization.

What You’ll Build & Own

• Design, build, and maintain automation, playbooks, and systems for timely triage, investigation, and incident response, using sound software engineering practices and modern AI tools where they add value.
• Develop and refine high-signal detections so security findings are actionable and noise is minimized.
• Integrate security telemetry and tooling across our cloud and application stack to enable consistent investigation and self-service triage.
• Lead cross-functional incident response across applications, cloud infrastructure, endpoints, identity, and internal services.
• Translate incident data and response metrics into secure-by-design improvements alongside product and infrastructure teams.
• Continuously evaluate response procedures and partner across engineering, infrastructure security, IT, and operational teams to close gaps and improve the operating model.

What We’re Looking for

• Demonstrated capability in security engineering, detection engineering, or incident response.
• Hands-on experience investigating security incidents or suspicious behavior in complex environments.
• Practical experience with EDR, SIEM, SOAR, log-management, or equivalent detection-and-response tooling.
• Ability to write code and build software automation or detections in at least one relevant scripting or query language.
• Strong understanding of modern cloud infrastructure and SaaS security principles.
• Sound risk-based judgment when prioritizing threats and operational tasks.
• Ability to make sound, timely decisions with incomplete information during active incidents.
• Clear communication and cross-functional collaboration skills during high-pressure situations.

Preferred Experience

• Building self-serve security triage automation or AI-assisted response capabilities.
• Threat hunting, digital forensics, threat intelligence, or infrastructure-as-code security controls.
• Investigating complex security events within containerized or Kubernetes-based cloud environments.
• Translating security incident trends into architectural or systemic engineering improvements.
• Experience navigating security challenges in fast-paced, high-growth startup environments.

On-call Expectation

This position includes participation in a regular on-call rotation to support rapid response to critical security incidents and maintain operational resilience.