Langchain Security Engineer - Detection & Response at Langchain responsible for building detection, investigation, and response systems to secure the platform and AI agents. The role focuses on engineering scalable security monitoring and telemetry.
Responsibilities
You'll be the hands-on detection and response engineer responsible for how we see, stop, and learn from threats across LangChain's production platform, cloud infrastructure, and the services that host and execute agentic workloads. You'll partner closely with Product Security to turn threat models, vulnerabilities, and incidents into telemetry, detections, and durable defenses. Your primary focus is engineering: building detection, investigation, and response systems that scale the Security team's impact beyond what manual operations allow. We are looking for engineers who think like builders, not just operators — strong software skills are a must.
This role participates in an incident on-call rotation, but its core focus is engineering systems that reduce risk, speed up investigations, and make incidents less frequent and less costly.
Location/City: San Francisco or NYC
Own the detection lifecycle: Translate threat models, incidents, and attacker behavior into telemetry requirements and detections-as-code. Validate coverage, measure signal quality, tune false positives, and continuously test whether defenses work.
Build security monitoring and telemetry: Design the telemetry pipeline end-to-end across cloud (GCP/AWS), Kubernetes, and the LangSmith/LangGraph control plane. Instrument services, define the signals that matter, and make security data reliable and useful.
Engineer investigations and threat hunting: Build tools and workflows for proactive hunting, evidence collection, incident scoping, and containment. Turn investigation findings into new detections and lasting improvements.
Use agents to scale the team: Build reliable internal AI agents and automation that triage alerts, enrich findings, gather evidence, scope incidents, and accelerate routine security work. Design human-in-the-loop controls and evaluations so automation is safe, observable, and trustworthy.
Lead incident response and participate in on-call: Triage, scope, contain, and remediate security incidents, then drive postmortems that produce durable engineering changes.
Partner with Product Security: Turn product threat models and vulnerability findings into production monitoring, and feed real-world detection and incident learnings back into secure design.
What you'll bring
5+ years in security engineering, with meaningful experience in detection engineering, security operations, or incident response — and the software skills to build your way out of repetitive work.
Strong software engineering in Python or Go (TypeScript a plus). You design maintainable systems and write production code, not just one-off scripts.
Qualification
Understanding of AI threatsAnnual salary range
Preferred
Experience building or operating AI agents for security workflows such as alert triage, investigation, evidence collection, or human-in-the-loop response.
Proficiency using AI tooling to accelerate security investigations and engineering work.
Understanding of AI threats, adversarial testing, and the security boundaries of LLM and agent workloads.
Exposure to SOC 2 or ISO 27001 monitoring and evidence automation.
Experience with infrastructure as code such as Terraform or Helm.
Experience securing both SaaS and self-hosted or air-gapped deployments.
