{"id":1164630,"url":"https://alion.io/job/runway-detection-response-engineer","title":"Detection & Response Engineer","company":{"id":559,"name":"Runway","domain":"runway.team","url":"https://alion.io/company/runway","size_band":null,"is_staffing_agency":false,"is_intermediary":false,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":93,"open_postings":37,"ghost_share":0,"stale_share":0.297,"repost_share":0,"time_to_fill_p50_days":59,"computed_at":"2026-09-24T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":240000,"max":290000,"currency":"USD","period":"year","gross":null,"usd_annual":290000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"HPC","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Python","optional":false},{"name":"Runway","optional":false},{"name":"Rust","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"TypeScript","optional":false},{"name":"World Models","optional":false}],"status":"live","first_seen_at":"2026-09-24T00:52:48Z","employer_posted_date":"2026-09-24","last_verified_at":"2026-09-24T09:22:34Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"We are building AI to simulate the world through merging art and science.\nWe believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems - robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world.\nWorld models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached.\nOur team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you.\nAbout the role\nOpen to hiring remote - we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv.\nRunway is hiring a Detection & Response Engineer to own how we find and stop attacks against our infrastructure, our research environment and our products.\nSecuring a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what you need to see to catch it.\nYou'll join the Security team and build our detection and response program the way an engineer would: detections as code, response as automation, evidence as something you can query. This is a role with real ownership: you'll own the detection program end to end, from what we log to how quickly we close an incident. You'll report to the head of security, partner with engineers across platform and research, and shape how this function grows from here.\nWhat you'll do\nOwn detection and response end to end: what we log, what we alert on, how we triage and how we recover\n\nWrite and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume\n\nLead incident response from the first alert through containment and forensics, then write the post-incident review people actually read\n\nBuild automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit\n\nMonitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls\n\nPartner with platform and research engineers so new systems ship with logging and response playbooks in place on day one\n\nRun threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find\n\nTurn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team\n\nParticipate in an on-call rotation for security incidents\n\nWhat you'll need\nHands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward\n\nExperience building and tuning detections in a modern SIEM, ideally managed as code\n\nWorking knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs\n\nComfort writing Python, Typescript, Rust or another language to automate response work and connect security tools\n\nFamiliarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity\n\nClear writing. Incident timelines, detection documentation and updates to leadership are all part of the job\n\nJudgment about what to alert on, what to automate and when to wake someone up\n\nEven better if you have\nExperience monitoring GPU or HPC-style infrastructure, or research environments with large datasets\n\nExperience building detections or guardrails for AI agents, LLM tooling or MCP servers\n\nCloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custody\n\nPublished open source detection content\n\nRunway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide.\nThere are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range.\nLastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates.\nWorking at Runway\nGreat things come from great teams.We’d love to hear from you.\nWe’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply.\nMore about Runway\nUniversal World Simulator\n\nGWM-1\n\nGen-4.5\n\nGeneral World Models\n\nRobotics SDK\n\nConversational Real-time Agents\n\nRunway Studios\n\nWe're excited to be recognized as a best place to work:\nCrain's | InHerSight | BuiltIn NYC | INC","description_format":"text","description_chars":6100,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Real Estate","Mobile Games","Property Management"],"lifecycle":[{"event":"open","at":"2026-09-24T01:56:32Z"}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":59,"reasons":["conf:0","win:early"],"computed_at":"2026-09-24T05:45:00Z"},"pay":{"stated_usd_annual":290000,"is_top_pay":true},"html_url":"https://alion.io/job/runway-detection-response-engineer","json_url":"https://alion.io/job/runway-detection-response-engineer.json","meta":{"generated_at":"2026-09-24T09:29:28Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers"}}