{"id":4197344,"url":"https://alion.io/job/openai-threat-detection-and-response-engineering-manager","title":"Threat Detection and Response Engineering Manager","company":{"id":2,"name":"OpenAI","domain":"openai.com","url":"https://alion.io/company/openai","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":80,"open_postings":214,"ghost_share":0,"stale_share":0.78,"repost_share":0.009,"time_to_fill_p50_days":51,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Leadership","role_family":"Leadership","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":401000,"max":510000,"currency":"USD","period":"year","gross":null,"usd_annual":510000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Kubernetes","optional":false},{"name":"OpenAI","optional":false}],"status":"live","first_seen_at":"2026-11-12T17:00:03Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-12T20:53:37Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About the team\nOpenAI’s mission depends on developing and deploying powerful AI responsibly. Security makes that possible by protecting our research, people, products, and users while enabling progress. We defend sensitive research and other intellectual property, customer data, and the infrastructure behind frontier AI-from GPU supercomputing and multicloud environments to datacenters and emerging agent systems. Threat Detection Engineering builds and operates the detections and investigative workflows that turn adversary activity into effective response.\nAbout the role\nWe’re looking for a hands-on technical leader to guide the engineers who identify and investigate threats to OpenAI and build the capabilities to contain them. You’ll hire and develop engineers, set technical direction, and prioritize risks to OpenAI’s intellectual property, customer data, and critical infrastructure.\nYour team will take an agent-first approach across the detection and response lifecycle, using OpenAI’s models to develop detections, triage signals, investigate suspicious activity, and support bounded response and continuous improvement. You’ll turn advances in model capability into dependable defenses, own their effectiveness, and work with security, research, and infrastructure partners to ensure findings lead to effective action. You’ll establish where agents can act independently and where human judgment and approval are essential.\nIn this role, you will:\nHire, coach, and develop engineers. Set clear expectations, provide regular feedback, grow technical leadership, and build a team that reviews work rigorously and learns from missed detections and noisy signals.\n\nSet a threat-informed roadmap. Prioritize detection work based on how external and internal actors could target the systems where we train and evaluate frontier models, the production services that run inference and power our products worldwide, the datacenter hardware and networks that support both, and the devices, identities, and applications employees rely on. Balance investment in emerging threats with closing known coverage gaps and keeping existing detections effective.\n\nOwn detection and investigation as a complete workflow. Embed agent-driven triage and investigation in the detections your team operates. Surface findings when the evidence points to a likely threat that warrants action. When a finding warrants formal incident response, bring the evidence to the Security Incident Response Team (SIRT) and support the investigation SIRT leads.\n\nBuild response and containment capabilities tailored to our infrastructure. Work with infrastructure and system owners to develop and test the controls responders need to contain threats in their environments. Define when human approval is required and how to verify that containment worked.\n\nApply models across the detection engineering lifecycle. Use OpenAI’s models to help develop threat hypotheses, author and test detections, deploy and tune them, and incorporate investigation findings into better coverage. Evaluate the effectiveness of individual agents and the complete workflows they support.\n\nTurn model advances into tested defenses. Prototype new approaches using OpenAI’s models, evaluate them against realistic adversary behavior and analyst baselines, and move successful experiments into production. Use operational evidence to identify model limitations and partner with Research and Engineering to address them.\n\nAnticipate emerging threats. Translate adversary intelligence and incident findings into testable detection hypotheses. Work with researchers and infrastructure owners on risks specific to a frontier AI lab, such as increasingly capable agents operating across systems with access to sensitive research. Determine what evidence would reveal compromise and what response would be effective.\n\nEstablish the visibility needed to detect, investigate, and respond. Partner with Security Observability and infrastructure owners to define telemetry and forensic data requirements. Drive improvements where missing evidence, unreliable data, or limited controls prevent the team from identifying threats or taking effective action.\n\nEngineer for measurable security outcomes. Use replay, adversarial validation, and regression testing to assess whether workflows find intended threats, distinguish benign activity, and reach defensible conclusions. Establish code review, documentation, staged rollout, monitoring, and rollback practices. Measure coverage, investigation accuracy, time to identify threats, and effectiveness of response.\n\nContribute during incidents. The Security Incident Response Team (SIRT) leads formal incident response. Your team contributes investigative expertise and uses incident findings to improve detections.\n\nYou might thrive in this role if you:\nThink like an adversary and demand evidence as a defender. You question whether apparent coverage would survive a determined attacker, distinguish plausible explanations from supported conclusions, and stay accountable for threats that existing tools and playbooks miss.\n\nHave managed security or software engineers and can demonstrate how you have hired, coached, developed technical judgment, and improved a team’s ability to deliver.\n\nAre a hands-on builder who can prototype tools, write and review code, and guide engineers through complex detection, investigation, and response designs.\n\nBring strong AI fluency and have built systems that test how models or agents can improve cyber defense. You have evaluated real security workflows against meaningful baselines and can explain what improved, what failed, and what you changed. You understand model failure modes and design reliable workflows with bounded permissions and clear human decision points.\n\nHave built or operated threat detections and led technical investigations. You understand adversary tradecraft and can assess evidence, scope, and uncertainty across complex environments.\n\nUnderstand how identity, endpoint, cloud, Kubernetes, and infrastructure telemetry supports investigations. You can reason about response and containment in unfamiliar systems and work with their owners to build practical capabilities.\n\nHave used testing and operational feedback to improve security outcomes. You can explain tradeoffs among coverage, accuracy, speed, and human workload, and choose measures that reflect whether threats are being found and addressed.\n\nCan build a focused roadmap and strong cross-functional partnerships in a rapidly changing environment. You enable researchers and engineers to move quickly while following through on security requirements and dependable operations.\n\nAbout OpenAI\nOpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. We push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through our products. AI is an extremely powerful tool that must be created with safety and human needs at its core, and to achieve our mission, we must encompass and value the many different perspectives, voices, and experiences that form the full spectrum of humanity.\nWe are an equal opportunity employer, and we do not discriminate on the basis of race, religion, color, national origin, sex, sexual orientation, age, veteran status, disability, genetic information, or other applicable legally protected characteristic.\nFor additional information, please see OpenAI’s Affirmative Action and Equal Employment Opportunity Policy Statement.\nBackground checks for applicants will be administered in accordance with applicable law, and qualified applicants with arrest or conviction records will be considered for employment consistent with those laws, including the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act, for US-based candidates. For unincorporated Los Angeles County workers: we reasonably believe that criminal history may have a direct, adverse and negative relationship with the following job duties, potentially resulting in the withdrawal of a conditional offer of employment: protect computer hardware entrusted to you from theft, loss or damage; return all computer hardware in your possession (including the data contained therein) upon termination of employment or end of assignment; and maintain the confidentiality of proprietary, confidential, and non-public information. In addition, job duties require access to secure and protected information technology systems and related data security obligations.\nTo notify OpenAI that you believe this job posting is non-compliant, please submit a report through this form. No response will be provided to inquiries unrelated to job posting compliance.\nWe are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made via this link.\nOpenAI Global Applicant Privacy Policy\nAt OpenAI, we believe artificial intelligence has the potential to help people solve immense global challenges, and we want the upside of AI to be widely shared. Join us in shaping the future of technology.","description_format":"text","description_chars":9231,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Conversational AI","Code Intelligence","AI Research Labs"],"lifecycle":[{"event":"open","at":"2026-11-12T20:53:37Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 262 · green card filings: 3","filings_12m":262,"filings_prev_12m":114,"green_card_filings_12m":3,"median_offered_wage_usd":272217,"route":null,"cap_exempt":false,"checked_at":"2026-11-12T07:36:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":51,"reasons":["conf:1","win:early","comp:brand"],"computed_at":"2026-11-12T22:32:50Z"},"pay":{"stated_usd_annual":510000,"is_top_pay":true},"html_url":"https://alion.io/job/openai-threat-detection-and-response-engineering-manager","json_url":"https://alion.io/job/openai-threat-detection-and-response-engineering-manager.json","meta":{"generated_at":"2026-11-12T22:32:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":47696,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2},"rest":"https://alion.io/mcp/rest/get_company?id=2"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fopenai-threat-detection-and-response-engineering-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fopenai-threat-detection-and-response-engineering-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fopenai-threat-detection-and-response-engineering-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/openai-threat-detection-and-response-engineering-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fopenai-threat-detection-and-response-engineering-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4197344}},{"tool":"search_jobs","arguments":{"company":"openai.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4197344},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}