{"id":3824267,"url":"https://alion.io/job/litellm-senior-security-operations-detection-engineer","title":"Senior Security Operations / Detection Engineer","company":{"id":20631,"name":"LiteLLM","domain":"litellm.ai","url":"https://alion.io/company/litellm","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":100,"open_postings":12,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":46,"computed_at":"2026-11-07T05:47:08Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":220000,"max":280000,"currency":"USD","period":"year","gross":null,"usd_annual":280000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"GitHub","optional":false},{"name":"LiteLLM","optional":false},{"name":"LLM","optional":false},{"name":"Okta","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-11-05T15:59:15Z","employer_posted_date":"2026-11-05","last_verified_at":"2026-11-07T22:04:38Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":1},"description":"LiteLLM is an open-source AI Gateway that gives developers a unified interface to LLM providers. We’re looking for a Senior Security Operations / Detection Engineer to build and own detection and response across our infrastructure.\nAbout the role\nYou’ll own what we can see and how we respond: log pipelines, detections, runbooks, alert handling, and incident coordination.\nThis is a hands-on individual contributor role reporting to our security lead. You’ll work directly with engineering to build and operate a detection and response function suited to a small company. San Francisco is preferred.\nYou’ll own your roadmap, build and run the tooling yourself, and lead incidents with incomplete information. Strong written communication is essential: you’ll coordinate independently with engineers, customers, and vendors across time zones.\nResponsibilities\nBuild and maintain security log pipelines and document coverage gaps.\n\nBuild, validate, and tune detections across cloud infrastructure, CI systems, identity providers, and internal services.\n\nManage detections as code, with clear documentation and ongoing maintenance.\n\nWrite and maintain a runbook for every alert.\n\nDefine severity-based alert response SLAs and own performance against them.\n\nLead incidents from investigation and containment through recovery and follow-up.\n\nProduce clear incident timelines, reports, and recommendations.\n\nMeasure and improve time to detect and contain threats.\n\nAutomate detection of unexpected identity and access changes and drive remediation.\n\nPrioritize improvements based on risk and the needs of a small engineering organization.\n\nWhat we’re looking for\n5+ years of relevant experience.\n\nExperience building a detection and response function from scratch.\n\nHands-on experience building and tuning SIEM detections, preferably in Splunk, and managing them as code.\n\nExperience building log pipelines from cloud and CI systems.\n\nStrong familiarity with GitHub, Okta, and cloud audit logs, including their limitations.\n\nExperience leading incidents end-to-end and making containment decisions on partial information.\n\nUnderstanding of OAuth, personal access tokens, OIDC, and how attackers abuse authentication systems.\n\nAbility to write Python scripts to investigate incidents and automate security operations.\n\nStrong independent judgment and experience owning priorities with limited oversight.\n\nClear communication under pressure and a willingness to surface bad news early.\n\nAvailability to overlap with Pacific working hours.\n\nBonus points\nYou helped build a detection and response function at a growing technology company.\n\nExperience in managed detection and response or incident response across multiple customer environments.\n\nExperience partnering closely with engineers in a small, fast-moving team.\n\nWhy join LiteLLM?\nOwn detection and response across the environment, from collecting logs to leading incidents.\n\nBuild a function around the needs of a small company.\n\nWork directly with security and engineering to close the gaps you find.\n\nSet priorities and implement improvements yourself.\n\nAbout LiteLLM\nLiteLLM provides a unified API for LLM providers, along with routing, authentication, budgets, observability, and governance for production AI systems.","description_format":"text","description_chars":3272,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["LLM & Generative AI","AI Compute & Inference","AI Development Tools"],"lifecycle":[{"event":"open","at":"2026-11-05T17:58:42Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":46,"reasons":["conf:4","win:early"],"computed_at":"2026-11-07T05:47:08Z"},"pay":{"stated_usd_annual":280000,"is_top_pay":true},"html_url":"https://alion.io/job/litellm-senior-security-operations-detection-engineer","json_url":"https://alion.io/job/litellm-senior-security-operations-detection-engineer.json","meta":{"generated_at":"2026-11-08T01:57:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4265,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":20631},"rest":"https://alion.io/mcp/rest/get_company?id=20631"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flitellm-senior-security-operations-detection-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flitellm-senior-security-operations-detection-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flitellm-senior-security-operations-detection-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/litellm-senior-security-operations-detection-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flitellm-senior-security-operations-detection-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3824267}},{"tool":"search_jobs","arguments":{"company":"litellm.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3824267},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}