Detection & Response Engineer
Remote$240k - $290kFull-timePosted 4w ago
About the role
Runway is hiring a Detection & Response Engineer to own how we find and stop attacks against our infrastructure, research environment, and products. The role focuses on detections as code, automation, and evidence collection across cloud, Kubernetes, endpoints, and SaaS, with ownership from logging to incident closure.
Responsibilities
- Own detection and response end to end: what we log, what we alert on, how we triage and how we recover
- Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume
- Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read
- Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit
- Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls
- Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one
- Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find
- Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team
- Participate in an on-call rotation for security incidents
Qualifications
- Hands-on incident response experience: triaged live alerts, led investigations and written post-incident reports
- Experience building and tuning detections in a modern SIEM, ideally managed as code
- Working knowledge of attacker movement through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what logs are left behind
- Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools
- Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity
- Clear writing abilities for incident timelines, detection documentation, and updates to leadership
- Judgment about what to alert on, what to automate and when to wake someone up
Skills
Required:Incident responseDetections as codeCloud and Kubernetes securityProgramming for automation
Benefits
- Salary range $240K – $290K (USD)
- Remote-friendly with offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv
- Collaborative, growth-focused team culture
- Career development and ownership of security program
Last updated Oct 25, 2026. Interested? Apply on the company site.
About Runway
Make anything.
Generate images and video with AI. Text to video, image to video, plus more. Runway's AI image and video generation tools trusted by millions worldwide
AI Image and Video GeneratorAI toolsText to videobrex-fastest-growing-2025image to videoliquid-ai-recruiting-target
More open roles at Runway
- Forward Deployed EngineertodayRemote · Commercial
- Sr/Staff Product Manager, Research ProductstodayRemote · Product
- Member of Strategic Staff, Model EcosystemtodayRemote · Operations & Partnerships
- Prototype ResearchertodayRemote · Runway Labs
- Strategic FinancetodayRemote · Finance