Staff / Principal Software Engineer, Detection and Response

You'll build the detection and response capability that catches attackers before they matter - across Lovable's corporate, production, and AI-agent surfaces.

Responsibilities

Build the detection engineering platform (pipelines, detections-as-code, automated triage, and response playbooks); Design and own security incident response process with 24/7 coverage, with a small, high-leverage human and agent team; Lead incidents end-to-end: detection, containment, eradication, post-mortem, and follow-through; Hunt proactively across corporate, production, and AI-agent surfaces and turn every finding into a durable detection; Define what 'world-class D&R for an AI-native company' looks like, and build it

Requirements

8+ years in detection engineering, incident response, or threat hunting; at least 3 years at staff/principal level; Strong engineering background, building detections as code rather than saved SIEM searches; Deep experience with cloud telemetry (GCP/AWS/Cloudflare), endpoint EDR, identity logs, and modern SIEM/data-lake stacks (Panther, Elastic, Snowflake/Clickhouse); Battle-tested incident commander who has led real high-severity incidents from first alert to public post-mortem; Adversary-minded: comfortable with MITRE ATT&CK, threat intel, purple-teaming, and red team collaboration

Nice to have

Detection for LLM/agent abuse; Prompt injection at scale; Insider risk in AI-augmented engineering orgs