SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 280,000 - 385,000 / annual
Harvey is an AI-native software platform for professional services, combining frontier agentic AI with enterprise-grade infrastructure and deep domain expertise. The company is at a critical inflection point with strong product-market fit and world-class investor backing.
You will lead Harvey's Detection and Response function, owning the strategy, technical direction, and operational readiness across production and corporate environments. Reporting to the CISO, you'll work cross-functionally with Engineering, Infrastructure, IT, Legal, and Customer Trust to translate business risk into a focused security program that protects customer data while enabling rapid innovation.
Key responsibilities include:
- Building and leading the Detection and Response team: hire and develop detection engineers, incident responders, and technical leaders; establish ownership, culture, and clear roadmap with staffing and investment decisions.
- Owning incident response and crisis readiness: lead response to major security incidents with investigation, containment, recovery, and executive communication; build severity criteria, escalation paths, playbooks, and 24/7 coverage for critical threats; develop incident commanders through exercises.
- Building detection as an engineering capability: set technical direction for telemetry, detection pipelines, forensic tooling, and response automation across cloud, endpoint, identity, SaaS, and application layers; apply software engineering practices to improve signal quality and reduce manual work; evaluate AI-assisted investigation with measurable quality and appropriate oversight.
- Focusing defenses on meaningful threats: use threat intelligence, hunting, and attacker perspective to prioritize scenarios including account compromise, data theft, insider risk, privileged-access abuse, and AI-workflow abuse; partner with offensive security to validate coverage.
- Making response a company capability: partner on sensitive investigations and crisis decisions; establish clear escalation and decision authority; preserve evidence and provide findings to support legal notification decisions; prepare cross-functional responders.
- Turning incidents into lasting improvements: drive blameless reviews with owned corrective actions; measure detection coverage, time to detect/contain, failure modes, and responder workload to guide investments.
This is a technical leadership role requiring someone who can build an exceptional team, earn trust of senior engineers, and bring clarity to high-stakes situations. You'll develop a function that scales through software, automation, and strong partnerships while staying close enough to challenge detection designs and guide complex investigations.
REQUIREMENTS:
- Experience building and leading Detection and Response, incident response, or security engineering teams in technology companies with complex production systems; demonstrated record of hiring strong engineers, developing technical leaders, and scaling teams and operating models.
- Deep incident response experience and demonstrated judgment during serious security events; ability to lead investigations with incomplete information, make timely containment decisions, and communicate clearly with executives, engineers, and business partners; composure, integrity, and discretion under scrutiny.
- Strong technical foundations in cloud infrastructure, operating systems, networking, identity, and attacker tradecraft, with depth in detection engineering, threat hunting, or digital forensics; ability to investigate across corporate and production environments.
- Engineering approach to security operations backed by experience building detection platforms, investigation tools, or response automation; ability to evaluate architecture and code, guide senior engineers, and make practical build/buy/retire decisions.
- Ability to turn business risk into focused strategy and deliver through influence and partnership; balance urgent response with long-term engineering work; build demanding, supportive environment.
- Especially valuable: experience protecting enterprise SaaS, sensitive customer data, or AI/ML environments; investigating insider threats; partnering on privileged-access governance; leading response under regulatory and public scrutiny.
About Harvey
Legal / Compliance / Risk; AI / Data / Infrastructure — AI platform for legal and professional services work.
