SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Anyscale is building the commercial platform around Ray, an open-source distributed computing framework used by OpenAI, Uber, Spotify, Instacart, and Cruise to power AI and ML workloads at scale. The company is backed by Andreessen Horowitz, NEA, and Addition with $250M+ raised.
As Senior Detection and Response Engineer, you will own the end-to-end detection and incident response capability for Anyscale's production and corporate environments. This is a high-ownership role reporting to the Head of Security with significant autonomy to shape how detection and response operates across the organization.
Key responsibilities include:
- Building and owning detection coverage across cloud (AWS, Azure), endpoint (EDR), and runtime telemetry
- Designing and maintaining a centralized correlation and alerting pipeline that converts telemetry into actionable detections
- Owning incident response processes: developing runbooks, defining escalation paths, and coordinating response during live incidents across corporate and production environments
- Detecting anomalous activity across Kubernetes and other infrastructure
- Tuning detections to maintain high signal-to-noise ratio and measuring detection/response performance (MTTR, MTTR)
- Conducting incident retrospectives and feeding findings back into detection rules and security controls
- Partnering with infrastructure security and IT teams to remediate gaps identified during incident response
In your first year, success means establishing strong detection coverage across cloud, endpoint, and runtime telemetry; operationalizing a working correlation and alerting pipeline; and developing and exercising incident response runbooks in practice.
REQUIREMENTS:
- 6+ years in security with strong focus on detection engineering and incident response, ideally at a high-growth startup
- Hands-on experience building detections and correlation across cloud platforms (AWS, Azure), endpoint detection and response (EDR), and ideally container and runtime telemetry
- Proven experience owning incident response end-to-end, including leading during live incidents
- Demonstrated ability to build and scale detection and response capabilities from the ground up, not just operate existing ones
- Sound judgment under pressure and clear communication during incidents
- Fluency working with engineering and IT teams to close security gaps
NICE TO HAVE:
- Experience with SIEM or detection platforms and detection-as-code approaches
- Familiarity with runtime security tooling (e.g., Upwind)
- Threat hunting or purple-team experience
- Background in AI/ML platforms or distributed systems
About Anyscale
AI / Data / Infrastructure — distributed computing and AI workload platform built around Ray.
