Security Engineer, Detection and Response

OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. As a Security Engineer on Detection & Response, you’ll help protect OpenAI’s most sensitive assets by building and operating systems to detect suspicious activity and respond effectively.

Responsibilities:

• Build and evolve Detection & Response capabilities across OpenAI’s infrastructure, products, and research environments, with an emphasis on high-signal detection and reliable operational response
• Engineer detection pipelines and tooling: develop rule lifecycle management, measurement/quality loops (coverage, precision, latency), tuning processes, and safe rollout patterns
• Automate response and investigations by building workflows that reduce toil (triage, enrichment, containment, evidence capture) and improve time-to-understand/time-to-contain
• Partner with other Security teams and system/infrastructure owners across the company to ensure new systems ship with the right telemetry, threat models, and response playbooks from day one
• Define D&R requirements and drive visibility across endpoints, identity, SaaS, cloud, Kubernetes: identify telemetry/control gaps, prioritize them, and advocate for fixes with partner teams (and implement directly when it’s the fastest/most effective path)
• Evaluate and respond to emergent security concerns in a frontier AI lab environment, such as detection and response strategies for agents operating across infrastructure at scale

Requirements:

• Hands-on threat detection and/or incident response experience, including building detections, running investigations, and improving operational playbooks
• Understanding of modern adversary tradecraft (TTPs) and ability to translate it into practical detection strategies and response actions
• Threat modeling mindset to evaluate new infrastructure or features, identify D&R implications, and turn that into concrete requirements for teams shipping the system
• Experience working in Kubernetes/containerized environments, including building detections from cluster telemetry and understanding common failure and attack modes
• Comfortable reasoning about lower-level infrastructure and datacenter risks, such as firmware/BMC surfaces, network segmentation/telemetry, and hard-to-observe control paths
• Experience across major cloud platforms (Azure, AWS, GCP, OCI), and ability to design cloud-agnostic detection approaches where possible
• Ability to build automation that replaces repetitive D&R work, including thoughtfully using agent-style workflows where they meaningfully reduce toil, while keeping outcomes measurable, auditable, and safe
• Energized by new problem areas at a forward-leaning technology company, thinking through how to detect and respond to agents operating across systems at scale, and turning those ideas into pragmatic telemetry and response requirements
• Clear communication and collaboration skills across teams, able to translate D&R needs into clear requirements, align stakeholders, and drive follow-through across technical and non-technical audiences
• Comfortable with scripting and enjoy using AI/agent tooling to accelerate investigations and automation