{"id":799165,"url":"https://alion.io/job/kikoff-staff-detection-response-engineer","title":"Staff Detection & Response Engineer","company":{"id":171844,"name":"Kikoff","domain":"kikoff.com","url":"https://alion.io/company/kikoff","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":83,"open_postings":17,"ghost_share":0,"stale_share":0.471,"repost_share":0,"time_to_fill_p50_days":72,"computed_at":"2026-10-03T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":337700,"max":387200,"currency":"USD","period":"year","gross":null,"usd_annual":387200},"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Okta","optional":false},{"name":"Python","optional":false},{"name":"Ruby","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"LLM","optional":true}],"status":"live","first_seen_at":"2026-09-11T18:51:13Z","employer_posted_date":"2026-09-11","last_verified_at":"2026-10-04T02:28:59Z","board_verified":true,"closed_at":null,"days_open":22,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":22},"description":"Kikoff: The Fintech Powering Financial Security at Scale\nKikoff is a profitable, pre-IPO fintech company on a mission to empower everyone to achieve financial security. With record revenue growth in 2025 and a unicorn valuation, we've built a suite of products that help millions of people build credit, access liquidity, and save money.\nWe're scaling fast. Join us if you want to build something meaningful and help millions of people move forward financially.\nWhy Kikoff:\nThis is a consumer fintech startup, and you will be working with serial entrepreneurs who have built strong consumer brands and innovative products. We value extreme ownership, clear communication, a strong sense of craftsmanship, and the desire to create lasting work and work relationships. Yes, you can build an exciting business AND have real-life real-customer impact.\nKikoff protects millions of customers and their financial data. This role owns the Detection & Response pillar: how we see what's happening across our environment, how fast we know when something is wrong, and how well we respond when it is.\nYou will own and dictate the detection and response roadmap. You define the detection strategy, decide what gets built versus bought, and drive the program from \"we have tools\" to \"we have coverage we can prove.\" This isn't a SOC analyst seat. You're building the detection capability for a fintech handling sensitive financial data, and you'll have real ownership from day one.\nIn This Role, You Will\nOwn the Pillar\nOwn the D&R roadmap end to end: telemetry strategy, detection engineering, alert quality, response process, and the metrics that prove coverage\nDecide our detection architecture. What we log, where it lands, what we build in-house, and where our partner tools fits.\nSet the bar for signal quality. Kill noisy alerts, tune what stays, and make on-call sustainable\nBuild Detection\nDesign and maintain detection coverage across AWS (CloudTrail, GuardDuty, VPC flow), endpoints (SentinelOne EDR), identity (Okta), SaaS, and CI/CD\nWrite detections as code: versioned, tested, mapped to real threats against a consumer fintech\nBuild the audit logging and telemetry pipelines that give us visibility at scale, including data access monitoring and detections for AI/agentic activity in our environment\nThreat model what an attacker actually does to a company like ours, and detect for that, not for a generic MITRE checklist\nRun Response\nOwn the incident response lifecycle: triage, containment, forensics, postmortem, remediation tracking\nLevel up our incident process in incident.io: runbooks, severity definitions, escalation paths, tabletop exercises\nLead technical investigations, including insider risk and unauthorized access cases\nEnable the Team\nBuild and run the InfoSec on-call rotation with real runbooks, not tribal knowledge\nAutomate response where it's safe: enrichment, containment actions, ticket hygiene\nBe the calm, technical voice in an incident who engineers trust\nQualifications\n6+ years in security with meaningful detection engineering and incident response experience in cloud-native environments (AWS strongly preferred)\nYou've written detections yourself: SIEM rules, or detection-as-code pipelines, and you've owned the false positive rate that came with them\nHands-on incident response experience. You've led real incidents, not just participated in them\nStrong command of Cloud Native logging and detection surfaces\nExperience with EDR at fleet scale and identity-based detection\nFluency in at least one language for automation (Python, Go, Ruby, or similar)\nComfortable in a fintech regulated environment\nBonus Points\nYou've stood up a detection program from scratch or near-scratch\nDetections for AI/LLM and agentic system abuse\nInsider threat and unauthorized access investigation experience\nConsumer fintech or financial services background\nBase Range\n$337,700—$387,200 USD\nEqual Employment Opportunity Statement\nKikoff Inc. is an equal opportunity employer. We are committed to complying with all federal, state, and local laws providing equal employment opportunities and considers qualified applicants without regard to race, color, religion, creed, gender, national origin, age, disability, veteran status, marital status, pregnancy, sex, gender expression or identity, sexual orientation, citizenship, or any other legally protected class.\nPlease reference the following for more information.","description_format":"text","description_chars":4430,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Personal Finance Apps & Education","Consumer Loans & Pawnshops"],"lifecycle":[{"event":"open","at":"2026-09-12T06:47:24Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 28 · green card filings: 6","filings_12m":28,"filings_prev_12m":12,"green_card_filings_12m":6,"median_offered_wage_usd":192794,"route":null,"cap_exempt":false,"checked_at":"2026-10-03T21:08:04+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":21,"expected_fill_days":72,"reasons":["conf:8","velocity","win:early"],"computed_at":"2026-10-03T05:45:00Z"},"pay":{"stated_usd_annual":387200,"is_top_pay":true},"html_url":"https://alion.io/job/kikoff-staff-detection-response-engineer","json_url":"https://alion.io/job/kikoff-staff-detection-response-engineer.json","meta":{"generated_at":"2026-10-04T02:44:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":4057,"day_limit":5000,"remaining_today":943,"minute_limit":60,"resets_at":"2026-10-05T00:00:00Z"}}}