Security Engineer, Detection & Response

Now is the time to join! Here's why:

• Build out our detection and response function. Liftoff has a mature security information and event management platform (SIEM), established detection content, and a working incident response program. Your charter is to take it to the next level — including leading our investment in AI-augmented SOC tooling.
• High visibility, high impact. Detection and response is a critical capability for Liftoff.
• Security-conscious engineering culture. Liftoff's engineering org is a willing and capable partner on security work.
• Hands-on technical work. Stay deep in code, detections, and incidents.
• Breadth of work. Detection and response is the primary focus, but you'll partner across the security team on cloud, infrastructure, and application security where the work demands it.
• Large-scale, interesting systems. Liftoff processes millions of requests per second across its demand-side platform (DSP), mobile software development kit (SDK), and ad exchange.

Responsibilities:

• Own day-to-day operation of Liftoff's SIEM (Panther) — log source ingestion, detection content, and the alert investigation pipeline.
• Lead Liftoff's adoption of AI-augmented SOC tooling (e.g. Prophet, Dropzone, or equivalent) as a multi-year modernization investment.
• Triage incoming security alerts and drive timely investigation and remediation with stakeholders across Engineering and IT.
• Lead incident response — investigation, containment, and post-incident review — and mature processes and runbooks so response becomes predictable and repeatable.
• Build tooling and automation that detects active threats, enriches alerts, and reduces manual investigation toil.
• Partner with Engineering and IT to make detection and response self-service where possible — clear log-onboarding paths, documented detection proposals, accessible runbooks — so security scales without becoming a bottleneck.
• Close the feedback loop between the team's offensive and proactive findings and detection coverage.