Senior Security Engineer, Detection & Response

5+ years of hands-on experience in security operations, detection engineering, incident response, threat hunting, or similar fields, or an equivalent combination.

Production-grade Python and Terraform. A meaningful majority of this role's output is building detections managed in code, logging pipelines and custom security tools to scale sec ops. You should be able to point to services or Lambdas you built and Terraform modules you own and have maintained in production.

Deep knowledge of adversarial tactics, techniques, and procedures, threat actor behavior, ATT&CK framework.

Proven experience building detections from scratch rather than only tuning commercial alerts into a production-quality detection with a low false positive rate.

Hands-on experience with SIEM or log analytics platforms and data lake technologies (OpenSearch, Elasticsearch, Clickhouse, Sentinel, Splunk, Datadog, AWS Athena, Azure synapse, Databricks or equivalent) and alerting/monitoring tooling.

Cloud-first Azure, GCP, AWS experience. Beyond instrumenting detections across cloud workloads, this role provisions and owns production security infrastructure in AWS: VPCs, IAM, networking, private service endpoints.

Experience in digital forensics, host-based detection, endpoint telemetry, process and network visibility, and cloud observability.

Experience responding to incidents in production environments: investigating logs, building timelines, establishing root cause, and containing.

Familiarity with security automation and orchestration, playbooks, response automation, and alert triage workflows.

Comfort as the primary owner of a domain. You will lead detection and response engineering, set your own priorities and move confidently where documentation is thin or stale.

Strong communication skills; the ability to translate complex detection logic, trade-offs and risk to engineers and to leadership.

A high degree of autonomy, initiative, and ownership, with the ability to drive entire initiatives with minimal oversight.

Experience building on or securing LLM and agent systems — Azure foundry, Bedrock/AgentCore, LangGraph, guardrails, policy-based authorization, prompt-injection defense, and agent evaluation.

Purple/Red team, App Sec or Production security experience. To develop proof of concepts against systems and simulate attacks, test controls and protections effectiveness. This position is not a full time red team position.

Vulnerability management program ownership (Wiz or comparable CSPM, bug bounty triage, SLA enforcement).

Fraud and abuse investigation in a multi-tenant SaaS product — account takeover, credential stuffing, trial and promo abuse, toll fraud.

Open source detection tooling contributions or public speaking at security conferences

🚀 Key moment to join Aircall in terms of growth and opportunities

💆‍♀️ Our people matter, work-life balance is important at Aircall

📚 Fast-learning environment, entrepreneurial and strong team spirit

🌍 45+ Nationalities: cosmopolite & multi-cultural mindset

💶 Competitive salary package & benefits

At Aircall, we believe diversity, equity and inclusion – irrespective of origins, identity, background and orientations – are core to our journey.

We pride ourselves on promoting active inclusion within our business to foster a strong sense of belonging for all. We’re working to create a place filled with diverse people who can enrich and learn from one another. We’re committed to ensuring that everyone not only has a seat at the table but is valued and respected at it by providing equal opportunities to develop and thrive.

We will constantly challenge ourselves to make sure that we live up to our ambitions around diversity, equity and inclusion, and keep this conversation open. Above all else, we understand and acknowledge that we have work to do and much to learn.

Want to know more about candidate privacy? Find our Candidate Privacy Notice here.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.