Security Software Engineer, Detection & Response

The shape of it

In the posting’s own words

We are looking for a Security Software Engineer, Detection & Response, to build the telemetry, logging, and response systems for our Detection & Response team. This is a builder role, not a queue-triage role. You will build detection and response as software across a multi-cloud fleet of servers, containers, and endpoints, and test where AI and agents can safely take work off responders. This is a hybrid role based in San Francisco, New York City, or London, with three days a week in the office.

What it asks for · 1

• Built or contributed to open source security or observability tooling

Also a plus

• Worked with managed SOC providers or security orchestration, automation, and response (SOAR) platforms
• Built or contributed to open source security or observability tooling
• Know serverless platforms and API security

What the job covers

• Deploy and operate telemetry at fleet scale with osquery and extended Berkeley Packet Filter (eBPF) sensors across servers, containers, and endpoints, and own performance overhead, staged rollouts, canaries, and rollbacks
• Build and maintain the logging and security information and event management (SIEM) pipeline behind detection, including ingestion, normalization, enrichment, storage, and cost, with detections written as code with tests, code review, and continuous integration and continuous delivery (CI/CD)
• Automate response with tooling for host isolation, credential revocation, evidence collection, and enrichment, and test where AI and agents can safely take work off responders
• Strengthen the corporate security stack, including endpoint detection and response (EDR) and fleet management across Mac, Windows, and Linux, email security, and GitHub controls
• Join the on-call rotation, work with the managed security operations center (SOC) on escalations, and automate evidence collection for System and Organization Controls 2 (SOC 2), Payment Card Industry Data Security Standard (PCI DSS), and ISO audits

Tools and skills named

Words the posting leans on

• security10×
• response7×
• detection6×
• code4×
• fleet4×
• logging4×
• agents3×
• build3×
• data3×
• endpoints3×
• infrastructure3×
• management3×
• platforms3×
• soc3×
• status3×
• telemetry3×

Counted from the posting after the mission statement and the legal notices are set aside. The ones near the top are the ones a screener is looking for.

More open at Vercel

• Account Executive, CommercialRemote - Germany
• Account Executive, MajorsHybrid - London
• Account Executive, Majors (APAC)Hybrid - Sydney
• Account Executive, Majors- Install Base (APAC)Hybrid - Sydney
• Account Executive-Startups, EMEA (French Speaker)Hybrid - London
• Account Executive- Startups, GreenfieldHybrid - San Francisco, New York City, Austin