Senior Security Engineer, Detection & Response

San Franciscofull timeRemote

Apply on Employer Site

senior

$138k–$252k

H1B: yes

Flexport The Senior Security Engineer at Flexport owns detection engineering and incident response across endpoint, identity, SaaS, and cloud environments. This role builds and tunes detections, leads incident response, and defines telemetry requirements to improve security posture.

Responsibilities

There is no MSSP and no tier-1 queue here. Detection & Response engineers own their detections end to end: you write them, you tune them, and your team is paged when they fire. The security team is spread across the globe with a follow-the-sun pager rotation so nobody is paged at 3am local.
The adversaries are real. The business is growing fast and the threat surface is growing with it. Defining the necessary telemetry is part of the job.
Detection engineering
Build and tune detections across endpoint, identity, SaaS, and cloud, treating them as software: version-controlled, peer-reviewed, and shipped through the same CI/CD practices the rest of engineering uses.
Track detection quality as measured quantities: coverage against MITRE ATT&CK, precision, time-to-detect. We don’t build-and-forget here.
Response & automation
Own incident response: triage, contain, remediate, and write the retrospective that turns the incident into a systemic fix.
Build automation that removes toil from investigations, and partner closely with the US-based team so context carries across time zones instead of getting lost at handoff.
Telemetry & partnership
Define telemetry requirements for new systems before they ship, working with infrastructure and product teams to close visibility gaps rather than discovering them during an incident.
Threat hunt proactively across the estate, converting hypotheses into either new detections or documented coverage.
Typically 5–8 years of experience in detection engineering, incident response, or threat hunting, with real hands-on time writing and tuning detections. We care more about what you've built than the exact number.

Qualification

Practical incident response experienceWe're agile

Required

5–8 years of experience in detection engineering, incident response, or threat hunting
Proficiency in at least one programming language (Python, Go, or similar)
Experience with a modern SIEM or detection pipeline (Panther, Elastic, Splunk, or similar)
Practical incident response experience

Preferred

Experience treating detections as code with CI/CD, peer review, and staged rollout.
Experience defining telemetry contracts for systems before they ship, rather than retrofitting logging after an incident.
A track record of critically evaluating and verifying AI-assisted work - testing, source-checking, validation - rather than trusting agent output by default. If you haven’t already spotted the em dashes in this job description and already thought about where the hiring manager (hi!) has put hands on keyboard and compared that to where they let the LLM watermarks through, you might not be the right person for the job.
Familiarity with cloud-native and Kubernetes telemetry.
Experience with fraud or financial-crime detection patterns.
We stay closely aligned with teammates on other continents via Slack, video, and async docs.
We have the latest hardware and software, including frontier AI models on day one.
We're agile, but not dogmatic. Teams decide how they work best.

Benefits

Dental
Equity/RSU

Company

Flexport

View company page

Source: greenhouse

Active within the past hour

Remote-friendly

More roles at Flexport

Enterprise Account Executive

U.S. Remote

Account Manager III, Fulfillment

Atlanta Warehouse

Staff Software Engineer, Autonomous Freight Systems

San Francisco

Staff Product Manager, Visibility

Bellevue

Boost Your Interview Chances

Improve Resume Match Score

Free

Your Score

9.0

Strong Applicant

Must-Have Skills for This Role

Detection EngineeringIncident ResponseThreat HuntingPythonGoSIEM

Optimize my Resume

Apply Faster with Autofill

Free

Save your profile once. LumiJobs pre-fills the employer's application form so you stop re-typing the same answers on every site.

Apply With Autofill

Or skip LumiJobs's tools and submit directly on the employer's career site.

Apply on Employer Site

Senior Security Engineer, Detection & Response at Flexport · LumiJobs