SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 280,000 - 385,000 / annual
Harvey is an AI-native software platform for professional services, combining frontier agentic AI with enterprise-grade infrastructure and deep domain expertise. The company is scaling rapidly with strong product-market fit and world-class investor backing.
You will lead Harvey's Detection and Response function, owning the strategy, technical direction, and operational readiness across production and corporate environments. Reporting to the CISO, you'll work cross-functionally with Engineering, Infrastructure, IT, Legal, and Customer Trust to translate business risk into a focused security program that protects customer data while enabling the company to move with confidence.
Key responsibilities include:
- Building and leading the Detection and Response team: hire and develop detection engineers, incident responders, and technical leaders; establish ownership, culture, and roadmap; own staffing and investment decisions.
- Owning incident response and crisis readiness: lead response to major security incidents, coordinate investigation and containment, build severity criteria and escalation playbooks, establish 24/7 coverage for critical threats, and develop incident commanders through exercises.
- Building detection as an engineering capability: set technical direction for telemetry, detection pipelines, forensic tooling, and response automation across cloud, endpoint, identity, SaaS, and application environments; apply software engineering practices to improve signal quality and reduce manual work; evaluate AI-assisted investigation with appropriate human oversight.
- Focusing defenses on meaningful threats: use threat intelligence, hunting, and attacker perspective to prioritize scenarios including account compromise, data theft, insider risk, privileged-access abuse, and abuse of AI workflows; partner with offensive security to validate coverage.
- Making response a company capability: partner on sensitive investigations and crisis decisions; establish clear escalation and decision authority; preserve evidence; provide findings to support legal notification and disclosure decisions; prepare cross-functional responders.
- Turning incidents into lasting improvements: drive blameless reviews, ensure corrective actions have owners and deadlines, measure detection coverage and time-to-detect, and use results to guide investments.
This is a technical leadership role requiring someone who can build an exceptional team, earn trust of senior engineers, and bring clarity to high-stakes situations. You'll develop a function that scales through software, automation, and strong partnerships while staying close enough to challenge detection designs and guide complex investigations.
Harvey operates with three core values: Decisiveness (act quickly on clear judgment), Simplicity (what scales), and Job's Not Finished (never satisfied with status quo). The team moves fast, takes ownership, and is deeply committed to the mission.
REQUIREMENTS:
- Experience building and leading Detection and Response, incident response, or security engineering teams in technology companies with complex production systems; demonstrated record of hiring strong engineers, developing technical leaders, and scaling teams and operating models.
- Deep incident response experience and demonstrated judgment during serious security events; ability to lead investigations with incomplete information, make timely containment decisions, and communicate clearly with executives, engineers, and business partners; composure, integrity, and discretion under scrutiny.
- Strong technical foundations in cloud infrastructure, operating systems, networking, identity, and attacker tradecraft, with depth in detection engineering, threat hunting, or digital forensics; ability to investigate across corporate and production environments.
- Engineering approach to security operations backed by experience building detection platforms, investigation tools, or response automation; ability to evaluate architecture and code, guide senior engineers, and make practical decisions about what to build, buy, or retire.
- Ability to turn business risk into focused strategy and deliver through influence and partnership; balance urgent response with long-term engineering work; build demanding, supportive environment.
- Especially valuable: experience protecting enterprise SaaS, sensitive customer data, or AI/ML environments; experience investigating insider threats; experience with privileged-access governance; experience leading response under regulatory and public scrutiny.
About Harvey
Legal / Compliance / Risk; AI / Data / Infrastructure — AI platform for legal and professional services work.
