Senior Security Operations / Detection Engineer

LiteLLM is an open-source AI Gateway that gives developers a unified interface to LLM providers. We’re looking for a Senior Security Operations / Detection Engineer to build and own detection and response across our infrastructure. ABOUT THE ROLE You’ll own what we can see and how we respond: log pipelines, detections, runbooks, alert handling, and incident coordination. This is a hands-on individual contributor role reporting to our security lead. You’ll work directly with engineering to build and operate a detection and response function suited to a small company. San Francisco is preferred. You’ll own your roadmap, build and run the tooling yourself, and lead incidents with incomplete information. Strong written communication is essential: you’ll coordinate independently with engineers, customers, and vendors across time zones. RESPONSIBILITIES - Build and maintain security log pipelines and document coverage gaps. - Build, validate, and tune detections across cloud infrastructure, CI systems, identity providers, and internal services. - Manage detections as code, with clear documentation and ongoing maintenance. - Write and maintain a runbook for every alert. - Define severity-based alert response SLAs and own performance against them. - Lead incidents from investigation and containment through recovery and follow-up. - Produce clear incident timelines, reports, and recommendations. - Measure and improve time to detect and contain threats. - Automate detection of unexpected identity and access changes and drive remediation. - Prioritize improvements based on risk and the needs of a small engineering organization. WHAT WE’RE LOOKING FOR - 5+ years of relevant experience. - Experience building a detection and response function from scratch. - Hands-on experience building and tuning SIEM detections, preferably in Splunk, and managing them as code. - Experience building log pipelines from cloud and CI systems. - Strong familiarity with GitHub, Okta, and cloud audit logs, including their limitations. - Experience leading incidents end-to-end and making containment decisions on partial information. - Understanding of OAuth, personal access tokens, OIDC, and how attackers abuse authentication systems. - Ability to write Python scripts to investigate incidents and automate security operations. - Strong independent judgment and experience owning priorities with limited oversight. - Clear communication under pressure and a willingness to surface bad news early. - Availability to overlap with Pacific working hours. BONUS POINTS - You helped build a detection and response function at a growing technology company. - Experience in managed detection and response or incident response across multiple customer environments. - Experience partnering closely with engineers in a small, fast-moving team. WHY JOIN LITELLM? - Own detection and response across the environment, from collecting logs to leading incidents. - Build a function around the needs of a small company. - Work directly with security and engineering to close the gaps you find. - Set priorities and implement improvements yourself. ABOUT LITELLM LiteLLM provides a unified API for LLM providers, along with routing, authentication, budgets, observability, and governance for production AI systems.