AI-Native Detection and Triage Engineer

10 hours, 56 minutes ago
Full-time
Senior
Cybersecurity
Fly.io

Fly.io

Fly.io provides a flexible and powerful compute platform that enables developers to deploy application servers and databases close to their users, utilizing advanced features such as global Anycast load balancing, zero configuration private networking,...

Internet Software & Services
11-50
Founded 2016
$40M raised

Description

  • Own eBPF telemetry coverage across hosts, including sensor lifecycle, SIEM ingestion, and detection logic.
  • Develop detections for compromised hosts, lateral movement, control-plane access, operator activity, secrets access, and AI workload abuse.
  • Manage AI security-review agents for merged pull requests, including prompts and repository coverage.
  • Own dependency, container image, and SBOM scanning across the codebase.
  • Help build a local full-stack platform replica, CI, and fuzzing/testing harness for isolation and security regression testing.
  • Operate a unified, prioritized triage workflow for SIEM alerts, scan findings, vulnerabilities, failing checks, and inbound disclosures.
  • Build and operate agents that safely triage, deduplicate, correlate, and enrich security findings.
  • Coordinate with engineering and infrastructure teams to investigate root causes, deliver fixes, and verify remediation.
  • Conduct proactive threat hunts and lead the detection and triage aspects of incident response.
  • Own the detection portion of the forensics playbook and manage an evolving, self-directed security engineering scope.

Requirements

  • Experience building and shipping detection or security-scanning pipelines for production systems.
  • Ability to analyze Linux authentication, audit, and kernel logs at the source.
  • Ability to review Go, Rust, or Elixir code changes and distinguish valid findings from scanner noise.
  • Production experience with eBPF-based telemetry, such as Tracee, Falco, Tetragon, or an equivalent solution.
  • Experience integrating security tooling into CI and working with fuzzers or test harnesses such as AFL, libFuzzer, or syzkaller.
  • Experience building agent or LLM tooling for operational data, including designing against prompt-injection risks.
  • Deep incident-response or threat-hunting experience.
  • Experience driving security findings to remediation across teams without direct authority.
  • Strong asynchronous writing skills for Slack and written design discussions.
  • Comfort building with coding agents and validating the quality and safety of their outputs.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Senior Detection Engineer

SentinelOne 1001-5000 Internet Software & Services

SentinelOne is seeking a Senior Detection Engineer to develop and optimize production threat detections across endpoint, cloud, network, and third-party data sources for its AI-native cybersecurity platform.

AWS Azure CI/CD Cybersecurity Git Linux Python SIEM
8 hours, 56 minutes ago

Network Security Engineer

FireMon.com 201-500 Professional Services

FireMon is seeking a hands-on Network Security Engineer to develop, test, and support integrations that enable its network security policy management platform to work across enterprise security devices and environments.

Cisco Juniper Network Security
11 hours, 11 minutes ago

Information Security Lead

Mama Money 201-500 Diversified Financial Services

Lead end-to-end security at Mama Money, a Cape Town-based fintech serving migrants and underserved communities, with a focus on securing APIs, partner integrations, cloud systems and regulatory controls.

AWS Bash Kubernetes OpenID Connect Penetration Testing Python Secrets Management SIEM Terraform
11 hours, 11 minutes ago

Manager Security Engineer, Operations

Fivetran 1001-5000 IT Services

Fivetran + dbt is hiring a remote US-based Manager of Security Operations, Incident Detection and Response to lead enterprise-wide threat detection, incident response, and security operations for its multi-tenant SaaS platform.

AWS Azure CrowdStrike Cybersecurity GCP JIRA Kubernetes Notion SIEM
2 days, 11 hours ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers