Aircall Senior Security Engineer at Aircall leads development and scaling of threat detection and response capabilities. Owns building detections, investigations, and the security data platform.
Responsibilities
As a Senior Security Engineer, Detection and Response you will develop, scale, and evolve Aircall's threat detection and response capabilities. You will take ownership of building detections from scratch, leading investigations, and driving the maturity of our detection program.
This is an owner-operator role. You will not be solely responding to alerts or consuming a detection platform that someone else runs, you will build and run it: the ingestion pipelines, the Terraform that defines them across sandbox, staging and production AWS accounts, the retention and cost posture, and the automation layered on top. Roughly two-thirds of the work is software and platform engineering; the remaining third is investigation, incident response and threat hunting. Expect to write production Python and Terraform every week, working alongside a product security, cloud and infrastructure security team you will partner with closely.
Our team builds the best solutions to our biggest problems, over the past year we've built our own AI SOC & IR agent, and we're applying those lessons to how we protect customer-facing AI products.
Leading direction and strategy of the DART program at Aircall
Lead end-to-end development of detection logic: from threat modeling and hypothesis to writing, testing, simulation, tuning, and deploying detection rules and alerts across logs, telemetry, host, network, and cloud.
Own the security data platform end to end. Operate and extend the SIEM and its ingestion pipelines, parsers, enrichment and normalization, defined as infrastructure-as-code and promoted from sandbox to production. Own its cost and capacity envelope and make the retention-versus-spend calls.
Experiment and build unique tools at the front of the security space that solve significant security challenges.
Expand and ship new security AI- and agent-based tooling for alert triage, investigation and detection building, including its authorization model, guardrails, evaluation harness and tracing.
Conduct threat hunts proactively in company wide and production environments, discovering anomalies and attacker behaviors before they escalate.
Lead incident response: investigate, contain, remediate, and perform root cause analysis. Drive post-incident reviews and feed lessons learned back into detection strategy.
Assess security around new product features, including AI- and LLM-backed services and opportunities for detections or protections
Author and maintain detection documentation, runbooks, alert definitions, tuning guidelines, and metrics.
