What You Will Do
- Build and operate the full detection and response stack, from log ingestion to incident triage
- Develop, tune, and maintain high-signal detection rules based on AngelList’s top risks
- Respond to and lead investigation of security events, including cross-functional incident coordination
- Automate alert triage workflows and reduce manual operational overhead
- Continuously hunt for threats and improve our ability to detect and respond to novel attacks
- Create tools to gather telemetry data from production systems and surface meaningful signals
- Author and maintain runbooks and incident playbooks to drive consistency and clarity in response
- Harness AI to scale triage, detection, and response—while understanding its blind spots
What We’re Looking For
- 7+ years of experience in security monitoring, incident response, and threat hunting in cloud environments
- Experience leading complex investigations with multiple stakeholders
- Demonstrated ownership of a full detection and response function
- Broader experience across other security engineering disciplines (e.g., product security, infra)
- Expertise in AWS security controls and services
- Deep understanding of SIEM and SOAR platforms and their configuration
- Familiarity with offensive techniques and real-world compromise scenarios
- Strong working knowledge of adversary TTPs and MITRE ATT&CK
- Hands-on experience with log analysis, anomaly detection, and correlation at scale
- Operating system internals and forensic analysis (Linux, macOS, Windows)
- Ability to analyze endpoint, network, and application telemetry
- Experience scripting or coding to automate detection and triage workflows
- Familiarity with DevOps toolsets and production environments
- Clear, concise communicator who can work across technical and non-technical teams
- Leadership mindset with a strong bias toward action and results
