Build and operate the full detection and response stack, from log ingestion to incident triage
Develop, tune, and maintain high-signal detection rules based on AngelList’s top risks
Respond to and lead investigation of security events, including cross-functional incident coordination
Automate alert triage workflows and reduce manual operational overhead
Continuously hunt for threats and improve our ability to detect and respond to novel attacks
Create tools to gather telemetry data from production systems and surface meaningful signals
Author and maintain runbooks and incident playbooks to drive consistency and clarity in response
Harness AI to scale triage, detection, and response—while understanding its blind spots

7+ years of experience in security monitoring, incident response, and threat hunting in cloud environments
Experience leading complex investigations with multiple stakeholders
Demonstrated ownership of a full detection and response function
Broader experience across other security engineering disciplines (e.g., product security, infra)
Expertise in AWS security controls and services
Deep understanding of SIEM and SOAR platforms and their configuration
Familiarity with offensive techniques and real-world compromise scenarios
Strong working knowledge of adversary TTPs and MITRE ATT&CK
Hands-on experience with log analysis, anomaly detection, and correlation at scale
Operating system internals and forensic analysis (Linux, macOS, Windows)
Ability to analyze endpoint, network, and application telemetry
Experience scripting or coding to automate detection and triage workflows
Familiarity with DevOps toolsets and production environments
Clear, concise communicator who can work across technical and non-technical teams
Leadership mindset with a strong bias toward action and results

Lead Security Detection Response Engineer

Key skills