Senior Security Operations / Detection Engineer

San Franciscofull timeOn Site

Apply on Employer Site

senior

$220k–$280k

H1B: no

Litellm The Senior Security Operations / Detection Engineer builds and owns detection and response across LiteLLM's infrastructure, including log pipelines, detections, runbooks, and incident coordination. This hands-on role requires leading incidents and automating security operations with strong communication skills.

Responsibilities

You’ll own what we can see and how we respond: log pipelines, detections, runbooks, alert handling, and incident coordination.
This is a hands-on individual contributor role reporting to our security lead. You’ll work directly with engineering to build and operate a detection and response function suited to a small company. San Francisco is preferred.
You’ll own your roadmap, build and run the tooling yourself, and lead incidents with incomplete information. Strong written communication is essential: you’ll coordinate independently with engineers, customers, and vendors across time zones.
Build and maintain security log pipelines and document coverage gaps.
Build, validate, and tune detections across cloud infrastructure, CI systems, identity providers, and internal services.
Manage detections as code, with clear documentation and ongoing maintenance.
Write and maintain a runbook for every alert.
Define severity-based alert response SLAs and own performance against them.
Lead incidents from investigation and containment through recovery and follow-up.
Produce clear incident timelines, reports, and recommendations.
Measure and improve time to detect and contain threats.
Automate detection of unexpected identity and access changes and drive remediation.

Qualification

5+ years of relevant experienceStrong familiarity with GitHubUnderstanding of OAuthWhy join LiteLLM?

Required

5+ years of relevant experience.
Experience building a detection and response function from scratch.
Hands-on experience building and tuning SIEM detections, preferably in Splunk, and managing them as code.
Experience building log pipelines from cloud and CI systems.
Strong familiarity with GitHub, Okta, and cloud audit logs, including their limitations.
Experience leading incidents end-to-end and making containment decisions on partial information.
Understanding of OAuth, personal access tokens, OIDC, and how attackers abuse authentication systems.
Ability to write Python scripts to investigate incidents and automate security operations.
Strong independent judgment and experience owning priorities with limited oversight.
Clear communication under pressure and a willingness to surface bad news early.
Availability to overlap with Pacific working hours.

Preferred

You helped build a detection and response function at a growing technology company.
Experience in managed detection and response or incident response across multiple customer environments.
Experience partnering closely with engineers in a small, fast-moving team.
Why join LiteLLM?
Own detection and response across the environment, from collecting logs to leading incidents.
Build a function around the needs of a small company.
Work directly with security and engineering to close the gaps you find.
Set priorities and implement improvements yourself.

Company

Litellm

View company page

Source: ashby

Active within the past hour

More roles at Litellm

Senior Security Engineer, Product & Platform

San Francisco

Senior Security Engineer

Remote

Account Executive

San Francisco

Forward Deployed Engineer (New Grad)

United States

Boost Your Interview Chances

Improve Resume Match Score

Free

Your Score

9.0

Strong Applicant

Must-Have Skills for This Role

SIEMSplunkGitHubOktaPythonOAuth

Optimize my Resume

Apply Faster with Autofill

Free

Save your profile once. LumiJobs pre-fills the employer's application form so you stop re-typing the same answers on every site.

Apply With Autofill

Or skip LumiJobs's tools and submit directly on the employer's career site.

Apply on Employer Site