About the role
The detection and response team watches every venture's production systems, endpoints and identity providers for signs that something has gone wrong. We write the detections, triage the alerts that matter, and run incidents from the first page to the post-mortem. The aim is to find an intrusion in minutes rather than weeks, and to contain it before it reaches model weights or customer data.
Frontier AI and Autonomy & Sensing hold assets that others would want badly: trained weights, sensor logs and evaluation data. Detection engineering here covers classic infrastructure and the AI-specific paths too, such as anomalous bulk exports from a model registry or prompt patterns that suggest extraction. Lessons from each incident feed into the permission model of Clexerl Go, so the agents working there stay within the bounds people set for them.
The team works in a blameless, written style. Detections ship with tests and a runbook, every incident gets a timeline and a post-mortem, and on-call rotations are sized so that nobody carries the pager alone for long.
What you’ll do
- Write and tune detection rules for endpoints, cloud control planes and identity logs, with tests that prove they fire.
- Triage high-severity alerts and lead incident response, coordinating containment across the affected venture and the shared platform.
- Build enrichment pipelines that join identity, asset and network data so analysts can answer who, what and where in one query.
- Hunt for intrusions proactively, using hypotheses drawn from threat intelligence, past incidents and red team findings.
- Write post-mortems that name the failure mode, the detection gap and the change that closes it, without assigning blame.
- Run tabletop exercises and replay recorded attack traces against new detections before they reach production.
- Automate routine containment steps, such as isolating a host or revoking a session token, behind approval gates.
What you’ll bring
- Experience in detection engineering or incident response, with real cases handled from first alert through to containment.
- Working knowledge of SIEM query languages and log pipelines, and of managing detections as code under version control.
- Familiarity with cloud control-plane logs, identity providers and endpoint telemetry across at least two platforms.
- Understanding of MITRE ATT&CK and the ability to map coverage gaps against it in a way that leads to action.
- Calm judgement in a live incident, and clear writing for readers who are not security specialists.
- Scripting ability in Python or Go for enrichment, tooling and quick analysis of large log sets.
Nice to have
- Experience detecting attacks on machine learning systems, such as model extraction, data poisoning or abusive prompt campaigns.
- Background in forensic analysis of memory, disk or container images.
- Familiarity with SOC 2 or ISO 27001 evidence collection for detection and response controls.
- Experience running a bug bounty or coordinated vulnerability disclosure process.
Work you might take on
- 01
Build a detection for bulk export of model weights from the registry, tuned to avoid paging on routine checkpoint syncs.
- 02
Create a replay harness that re-runs captured attack traces against every rule, so regressions show up before deployment.
- 03
Design an automated containment playbook for a compromised cloud service account, with approval gates and rollback steps.
- 04
Map detection coverage for Clexerl Go's agent actions against ATT&CK, and close the three largest gaps you find.
Compensation
$240K – $380K
The US base salary range for this role. Every offer also includes equity in Clexerl and, when it spins out, in the venture you help build. We tell you the reasoning behind your number.
Benefits
Health, fully covered
Medical, dental and vision for you and your dependants, premiums paid in full.
Two kinds of equity
Equity in Clexerl, plus a stake in the venture you help build when it spins out.
22 weeks parental leave
Fully paid, for every parent, however your family arrives.
Rest that sticks
Flexible time off with a four-week minimum we actually check on, plus a company-wide week in December.
Learning and compute
A yearly budget for courses, conferences and books, and compute credits for side projects.
401(k) with a 4% match
Matched from your first paycheque and vested immediately.
How we hire
Apply 5 minutes
Send links to what you have built and a few lines on why this role. No cover letter needed.
Intro call 30 minutes
A conversation with the hiring manager about the work, the team and what you want next.
Work sample 2–4 hours
A paid take-home or a pairing session on a real-shaped problem. You pick the format.
Studio day One day
Meet the team, go deep on your work and ours. Remote or in person.
Offer Within 5 days
A written offer with the full range, the equity and the reasoning behind both.
Opens an email with a short template. Links beat résumés.