{"id":560926,"url":"https://alion.io/job/legora-senior-or-staff-detection-response-engineer","title":"(Senior OR Staff) Detection & Response Engineer","company":{"id":48110,"name":"Legora","domain":"legora.com","url":"https://alion.io/company/legora","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":84,"open_postings":83,"ghost_share":0,"stale_share":0.651,"repost_share":0,"time_to_fill_p50_days":55,"computed_at":"2026-10-27T05:46:45Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":187000,"max":328888,"currency":"USD","period":"year","gross":null,"usd_annual":328888},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Function Calling","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"SQL","optional":false},{"name":"DLP","optional":true},{"name":"Incident Management","optional":true},{"name":"SIEM","optional":true},{"name":"YARA","optional":true},{"name":"YARA","optional":true}],"status":"live","first_seen_at":"2026-09-09T04:32:03Z","employer_posted_date":"2026-09-09","last_verified_at":"2026-10-27T21:53:07Z","board_verified":true,"closed_at":null,"days_open":48,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":48},"description":"About Us\nLegora is redefining how legal work gets done. Not built for lawyers, built with them. We work alongside the world’s best legal teams, who expect excellence, precision, and speed, and we hold ourselves to the same bar.\nOur AI-native workspace lets legal professionals move faster, think more clearly, and operate with sharper precision. By analysing thousands of documents in minutes and powering end-to-end workflows, we cut through complexity, teams can focus on what matters: judgment, strategy, and outcomes.\n2,100+ customers across 80+ countries trust us, including Cleary Gottlieb, Goodwin, Linklaters, White & Case, Dentons, and Barclays. We’ve scaled to $200M+ in ARR, with teams across Europe, North America and APAC, and continue to expand through acquisitions including Qura, Walter AI, Graceview, Cadastral, and Wexler.\nWe partner with world-class performers: including Aaron Judge and the New York Yankees, Ludvig Åberg (and his caddie), and campaigns featuring Jude Law.\nJoining Legora means three things.\nWe lean in: ownership over titles, outcomes over intentions.\n\nWe fight for excellence: high standards, direct, ego-free feedback.\n\nWegrow together: as a team and with our customers.\n\nMission before ego. Everyone contributes. No one coasts.\nIf you’re driven by impact, pace, and raising the bar. This is the place.\nAbout the team\nThe IT and AI Enablement function helps Legora run securely and reliably as we grow. We are building an AI-native Information Security function. We ship security controls as software, and agents handle first-pass triage and routine investigation. People make the high-impact calls.\nThis role owns detection and response across Legora's corporate and production environments: endpoints, identity, cloud workloads, SaaS, and the AI systems and agents we operate. Law firms trust Legora with sensitive work, so we expect capable, well-resourced attackers. Your job is to find and stop them.\nWhat you’ll be doing\nOwn detection and response across endpoints, identity, cloud workloads, SaaS, and Legora's AI systems. Hunt, triage, investigate, contain, and drive incidents through resolution, then turn what you learn into better detections and controls.\n\nBuild detections as production software on telemetry and pipelines provided by AI & Integrations Engineering. Keep them version-controlled, peer-reviewed, tested, and deployed through CI/CD. Measure coverage, precision, and time to detection, then tune where the data shows a gap.\n\nBuild threat models, telemetry, and response playbooks for our AI systems, agents, and their tool use. Detect misuse of agents operating across the company.\n\nBuild and supervise agents for triage, enrichment, and investigation. Set guardrails and approval thresholds for containment and other high-impact actions.\n\nMap coverage to MITRE ATT&CK and validate it through threat hunting, penetration-test findings, and adversary emulation.\n\nShare the on-call rotation and act as incident commander when security is involved. Engineering owns service reliability; Customer Trust and Legal own customer communications. Run post-incident reviews and use the findings to reduce detection and containment time.\n\nInvestigate insider risk and identity abuse with Corporate Security, People, and Legal. Work with Vulnerability Management on exposure priorities and IT Systems on the underlying estate.\n\nTrack actors and campaigns targeting AI companies and convert the intelligence into hunts and detections. Own the digital-risk platform and coordinate urgent phishing and impersonation takedowns.\n\nWho you are\n5+ years in detection engineering, incident response, or security operations, including work as a senior escalation point. For Staff, we expect roughly 10+ years and experience setting detection and response strategy.\n\nStrong software engineering skills in Python and SQL. You build detections, automations, and telemetry pipelines that run reliably in production.\n\nYou use LLMs and agents in day-to-day security work and know which decisions require a human. Be ready to show us an investigation or workflow you automated.\n\nFluent across endpoint, identity, cloud, and SaaS telemetry. You reason from attacker behaviour and correlate signals across systems.\n\nYou communicate clearly during incidents and turn incomplete technical evidence into sound decisions. Your post-incident reviews lead to concrete changes.\n\nNice to have\nExperience with a modern SIEM or security data lake and at least two relevant query or rule languages, such as SPL, KQL, YARA-L, Sigma, or SQL.\n\nExperience securing AI systems, agent tool use, and AI data flows, including prompt injection and exfiltration risks.\n\nExperience with response automation, incident management, digital forensics, or malware analysis.\n\nThreat intelligence, insider risk, or DLP experience.\n\nWhat’s In It For You\nGlobal collaboration: Partner with teams and clients across Europe, APAC, and North America.\n\nCompetitive package: Comprehensive salary, benefits, and tools for success.\n\nMeaningful work: Your efforts shape how thousands of lawyers use AI daily.\n\nIn-person environment: Union Square office designed for ambitious builders and company provided lunch daily.\n\nBenefits & Perks: We invest in our people with a comprehensive, thoughtfully designed benefits package: Medical, Dental & Vision\nMultiple medical plan options through Aetna and Kaiser Permanente\n\nHSA or Healthcare FSA (based on plan selection)\n\nDental plans via MetLife\n\nVision plans via Vision Care\n\nFamily Support\nGenerous parental leave\n\nFree access to Maven Clinic\n\nDependent Care FSA\n\nFree One Medical membership for employees and dependents\n\nAdditional Perks\nPre-tax commuter benefits\n\nLife Insurance + STD/LTD\n\n401(K) with generous company match\n\nUnlimited PTO\n\nRobust voluntary benefits, including identity protection (via Aura), legal coverage via MetLife, pet savings programs, and more\n\nLegora is an Equal Opportunity Employer\nAt Legora, we believe great teams are built on diversity of thought and experience. We’re proud to be an equal opportunity employer and committed to creating an inclusive, high-performance culture where everyone can do their best work. We welcome people of all backgrounds and don’t discriminate based on race, color, religion, national origin, gender, gender identity or expression, sexual orientation, age, disability, veteran status, or any other characteristic protected by law.","description_format":"text","description_chars":6436,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Life insurance","Parental leave","Unlimited PTO"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Document AI","Legal AI","Legal Software"],"lifecycle":[{"event":"open","at":"2026-09-09T04:41:42Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 1","filings_12m":1,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":162500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":35,"band":"fade","label":"Fading","p_open":1,"p_active":0.583,"p_room":0.6,"age_days":48,"expected_fill_days":55,"reasons":["conf:1","stale_co","velocity","win:late","crowd:brand"],"computed_at":"2026-10-27T05:46:45Z"},"pay":{"stated_usd_annual":328888,"is_top_pay":true},"html_url":"https://alion.io/job/legora-senior-or-staff-detection-response-engineer","json_url":"https://alion.io/job/legora-senior-or-staff-detection-response-engineer.json","meta":{"generated_at":"2026-10-27T22:13:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13808,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":48110},"rest":"https://alion.io/mcp/rest/get_company?id=48110"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flegora-senior-or-staff-detection-response-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flegora-senior-or-staff-detection-response-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flegora-senior-or-staff-detection-response-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/legora-senior-or-staff-detection-response-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flegora-senior-or-staff-detection-response-engineer"}]}