Detection & Response Engineer

Runway is building AI world models that combine art and science to simulate the world. The Detection & Response Engineer will own the end-to-end detection and response program, including security monitoring, incident response, automation, threat hunting, and evidence collection across infrastructure, research environments, and products.

Responsibilities:

• Own detection and response end to end: what we log, what we alert on, how we triage and how we recover
• Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume
• Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read
• Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit
• Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls
• Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one
• Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find
• Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team
• Participate in an on-call rotation for security incidents

Requirements:

• Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward
• Experience building and tuning detections in a modern SIEM, ideally managed as code
• Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs
• Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools
• Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity
• Clear writing. Incident timelines, detection documentation and updates to leadership are all part of the job
• Judgment about what to alert on, what to automate and when to wake someone up
• Experience monitoring GPU or HPC-style infrastructure, or research environments with large datasets
• Experience building detections or guardrails for AI agents, LLM tooling or MCP servers
• Cloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custody
• Published open source detection content