Headway Security Engineer (Detection & Response) at Headway builds capabilities to identify, respond to, and contain security threats across environments. Focuses on detection engineering, incident response, and AI security tooling.
Responsibilities
The Security team at Headway is responsible for the security and privacy of all of Headway's customers — therapists, patients, and payer partners (insurance companies and health systems). As a Security Engineer on our Detection & Response team, you'll help build the capabilities we use to identify, respond to, and contain potential threats across our production and corporate environments — ensuring our logging is adequate and accessible, our detections cover real-time monitoring and alerting, and our incident response is well-documented and well-rehearsed.
This role scales alongside the volume of data our business generates and consumes, and alongside our ambition to work smarter — not just harder — by applying automation and AI where it genuinely helps, and knowing when it doesn't.
Detection engineering: Build and refine detections, logging/telemetry coverage, and tooling (SIEM/ETL pipeline refinement) so we have real-time visibility into anomalous and malicious activity across cloud, corporate, and SaaS environments.
Incident response engineering: Run incident response activities, threat hunting, and threat modeling — and continuously improve our processes and documentation so the team gets faster and sharper after every incident.
AI security tooling and automation: Implement automation and AI where it's the right tool for the job — and push back when it isn't. You'll help define what "AI-forward" detection and response looks like at Headway without over-rotating on it.
Security alert triage: Triage security alerts and build deep familiarity with our environment so you can separate signal from noise quickly.
Team contributions: Participate in the security on-call rotation, author runbooks, contribute to security education and partnership across engineering, and mentor peers.
Documentation: Keep detections, logging capabilities, runbooks, response processes, and threat intel well-documented so knowledge compounds across the team.
Languages: Python 3, TypeScript
Infrastructure: AWS (Fargate, ECS, S3, and more)
Datastores: PostgreSQL, Snowflake
Monitoring & Response: Datadog, PagerDuty
Qualification
Experience with automation/SOAR toolingComprehensive benefitsMedicalHeadway participates in E-Verify
Preferred
Experience in a regulated environment (e.g. healthcare, finance, federal)
Experience with automation/SOAR tooling
Detection-as-Code or Infrastructure-as-Code experience
A track record of prioritizing and shipping risk-based detections, running threat modeling, or building alert pipelines
Comprehensive benefits:
Medical, dental, vision, HSA/FSA, 401(k) including match for 2027!, Carrot Fertility reimbursement, and paid parental, medical and caregiver leave.
We believe a team's strength is in its people, and we cannot achieve this mission without a team that reflects the diversity of this problem – across race, ethnicity, gender, sexuality, age, national origin, religion, family status, disability, military status, and experience. Headway is committed to the full inclusion of all qualified individuals. As part of this commitment, Headway will ensure that persons with disabilities are provided with reasonable accommodations. If reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or receive other benefits and privileges of employment, please inform the recruiter when they contact you to schedule your interview.
Headway participates in E-Verify. To learn more, click here.
