Detection & Response Engineer

Join Runway, a cutting-edge company focused on frontier video models. As a Detection & Response Engineer, you will be responsible for developing and implementing our detection and response program, with a focus on securing our unique research environment and products. You will work closely with the security team, platform engineers, and research engineers to ensure our systems are secure from attacks. This role offers real ownership and the opportunity to shape the future of our security function.

• Ownership of the detection and response program, including logging, alerting, triaging, and recovery.
• Writing and tuning detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints, and SaaS.
• Leading incident response from the first alert through containment and forensics, and writing post-incident reviews.

• Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs
• Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity
• Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools
• Clear writing. Incident timelines, detection documentation and updates to leadership are all part of the job
• Judgment about what to alert on, what to automate and when to wake someone up
• Experience building and tuning detections in a modern SIEM, ideally managed as code
• Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward
• Experience monitoring GPU or HPC-style infrastructure, or research environments with large datasets
• Experience building detections or guardrails for AI agents, LLM tooling or MCP servers
• Cloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custody
• Published open source detection content