Security Engineer, Detection and Response

About the role

As a Security Engineer on the Detection & Response team, you will protect OpenAI’s most sensitive assets by building and operating systems that detect suspicious activity and enable rapid, effective response. You will work across endpoints, identity, cloud, Kubernetes, and data‑center layers, collaborating with security and infrastructure owners to define telemetry and response requirements.

Key responsibilities

• Design, build, and evolve detection and response capabilities across OpenAI’s infrastructure, products, and research environments.
• Engineer detection pipelines and tooling, including rule lifecycle management, quality measurement, tuning, and safe rollout patterns.
• Automate investigation and response workflows to reduce manual toil and improve time‑to‑understand and time‑to‑contain.
• Partner with security teams and system owners to embed telemetry, threat models, and response playbooks from day one.
• Define D&R requirements, identify telemetry gaps across endpoints, identity, SaaS, cloud, and Kubernetes, and drive fixes or implement solutions directly.
• Assess and respond to emerging security concerns in a frontier AI lab, including strategies for agents operating at scale.

Required profile

• Hands‑on experience in threat detection and/or incident response, including building detections and improving operational playbooks.
• Deep understanding of modern adversary tactics, techniques, and procedures (TTPs) and ability to translate them into practical detection strategies.
• Strong threat‑modeling mindset to evaluate new infrastructure or features and define concrete D&R requirements.
• Experience working in Kubernetes or other containerized environments.

Required skills

• Kubernetes
• Cloud platforms
• Detection pipeline development
• Incident response
• Threat modeling