Note: The job is a remote job and is open to candidates in USA. OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. As a Security Engineer on Detection & Response, you’ll help protect OpenAI’s most sensitive assets by building and operating systems to detect suspicious activity and respond effectively.
Responsibilities
- Build and evolve Detection & Response capabilities across OpenAI’s infrastructure, products, and research environments, with an emphasis on high-signal detection and reliable operational response
- Engineer detection pipelines and tooling: develop rule lifecycle management, measurement/quality loops (coverage, precision, latency), tuning processes, and safe rollout patterns
- Automate response and investigations by building workflows that reduce toil (triage, enrichment, containment, evidence capture) and improve time-to-understand/time-to-contain
- Partner with other Security teams and system/infrastructure owners across the company to ensure new systems ship with the right telemetry, threat models, and response playbooks from day one
- Define D&R requirements and drive visibility across endpoints, identity, SaaS, cloud, Kubernetes: identify telemetry/control gaps, prioritize them, and advocate for fixes with partner teams (and implement directly when it’s the fastest/most effective path)
- Evaluate and respond to emergent security concerns in a frontier AI lab environment, such as detection and response strategies for agents operating across infrastructure at scale
Skills
- Hands-on threat detection and/or incident response experience, including building detections, running investigations, and improving operational playbooks
- Understanding of modern adversary tradecraft (TTPs) and ability to translate it into practical detection strategies and response actions
- Threat modeling mindset to evaluate new infrastructure or features, identify D&R implications, and turn that into concrete requirements for teams shipping the system
- Experience working in Kubernetes/containerized environments, including building detections from cluster telemetry and understanding common failure and attack modes
- Comfortable reasoning about lower-level infrastructure and datacenter risks, such as firmware/BMC surfaces, network segmentation/telemetry, and hard-to-observe control paths
- Experience across major cloud platforms (Azure, AWS, GCP, OCI), and ability to design cloud-agnostic detection approaches where possible
- Ability to build automation that replaces repetitive D&R work, including thoughtfully using agent-style workflows where they meaningfully reduce toil, while keeping outcomes measurable, auditable, and safe
- Energized by new problem areas at a forward-leaning technology company, thinking through how to detect and respond to agents operating across systems at scale, and turning those ideas into pragmatic telemetry and response requirements
- Clear communication and collaboration skills across teams, able to translate D&R needs into clear requirements, align stakeholders, and drive follow-through across technical and non-technical audiences
- Comfortable with scripting and enjoy using AI/agent tooling to accelerate investigations and automation
Benefits
- Offers Equity
Company Overview
Company H1B Sponsorship