Security Engineer, Detect & Respond

Join Betterment as a Security Engineer on the Detect and Respond team. You'll be responsible for building and operating detection capabilities, improving detections over time, and participating in security on-call cycles. This role is ideal for engineers with a security foundation who want to grow their skills in a collaborative environment. Enjoy competitive compensation, equity, comprehensive health coverage, flexible time off, and opportunities for growth and development.

Responsibilities

• Contribuer à l'amélioration des capacités de détection et de réponse à travers l'infrastructure de Betterment, en mettant l'accent sur la détection à fort signal et la réponse opérationnelle fiable.
• Participer aux cycles de sécurité sur appel, répondre aux alertes et aider à améliorer les processus de triage au fil du temps.
• Construire et maintenir des automatisations qui rationalisent l'expérience d'appel et réduisent le travail manuel pour l'ingénierie de la sécurité.

Requirements

• Exposure to incident response — alert triage, investigation, or containment work
• Curiosity and a willingness to dig into new tools, data sources, and problem spaces
• Strong written communication skills — you can write a clear runbook and explain a security concept to a non-technical colleague
• Experience with common industry SIEM and SOAR platforms, including writing searches and building alerts
• We're seeking a team member with 3+ years of experience in security operations or security engineering
• An interest in security engineering as a craft — you want to build things that are reliable, well-documented, and easy for others to maintain
• Awareness of the security questions AI systems raise — agent and connector permissions, prompt injection, non-human identity, data leaving through AI tools — or the drive to get up to speed quickly
• Enthusiasm for AI tools and workflows, with the judgment to know where their output needs verifying and the appetite to introduce new capabilities responsibly
• Familiarity with common attacker tactics and techniques, including frameworks like MITRE ATT&CK, and an interest in turning threat behavior into practical detections
• Familiarity with cloud environments (AWS) and common SaaS security tools like CrowdStrike or Okta
• Programming or scripting background; you're comfortable reading and writing code

Pay

USD 145,000 - 180,000