Detection and Response Engineers Who Manage Security Alerts as Code

Four companies opened the same title in two weeks

As of October 9, five companies that sell AI products were hiring detection and response (D&R) or incident response engineers, and four of them posted the role after September 28. Notion opened Security Engineer, Detection and Response on September 28 and Replit followed with Security Engineer, Incident Response on October 5. Databricks posted Staff Security Engineer, Incident Response on October 8, and Anthropic posted Senior/Staff Security Engineer, Detection & Response on October 9. Vercel's Security Software Engineer, Detection & Response, first published in July, is still open.

Anthropic's posting explains why AI companies are hiring here first. Its description of the role opens by noting that as its models grow more capable, so does the interest of people who want to attack or misuse them. An AI red team looks for weaknesses through an attacker's eyes. This specialization works the other side: it writes the detections that notice a real attack, and when an incident happens it narrows the damage and contains it.

The five postings share two things. First, they treat the work as software development. Notion says it views detection and response as a software engineering discipline in which detections are code, platforms are products, and measurement matters. Vercel calls its opening a builder role rather than a queue-triage role. Second, four of the five list LLM or agent tooling for detection and response as part of the job. Vercel describes it as testing where AI and agents can safely take work off responders.

The U.S. Bureau of Labor Statistics files this work under information security analysts and projects employment in that occupation to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. It expects about 14,100 openings a year over the decade, and the 2025 median pay was $129,180.

Proving the value of a quiet year

Security work has an awkward scorecard. When it goes well, nothing happens, and nothing is hard to put in a performance review. The newer postings answer that with measurement. Notion asks the engineer to help define and track metrics such as detection coverage, mean time to detect (MTTD), and alert quality. Replit wants blameless post-incident reviews whose fixes are driven to completion, and tabletop exercises that test readiness and find gaps.

All five postings include an on-call rotation. Alerts fire at night, and someone has to decide whether a burst of failed logins is an attack or a misconfigured script. That is why the measurement matters as much as the detection itself: a rule that pages people for nothing wears out the team that has to answer it, and a rule that stays silent during a real attack is worse.

Rules written as code, alerts measured for quality

The first gate is the language you write detections in. Notion asks for working knowledge of at least one detection or query language, such as Sigma, KQL, SPL, YARA-L or EQL, and says strong SQL or Python plus the drive to learn one quickly will also do. Deciding what to detect starts from a map of attacker behavior such as MITRE ATT&CK. Vercel requires detections to go through tests, code review and CI/CD like any other code.

The engineer also owns the data those rules read. Vercel's posting asks the hire to run osquery and eBPF sensors across servers, containers and endpoints, and to own their performance overhead and staged rollouts. The same posting covers the SIEM pipeline that ingests, normalizes, enriches and stores the logs, along with its cost. All five companies ask for cloud experience, and Replit names Google Cloud IAM, audit logging and GKE specifically.

Response splits into automation and command. The engineer builds the tools that isolate a host, revoke leaked credentials and sessions, and collect evidence. Replit wants someone who can act as incident commander, moving security, SRE, engineering and legal in one direction, and then lead the review afterward. Writing rounds it out. Notion asks for clear runbooks, design docs and incident notes, so that the next person paged at 3 a.m. can reach the same decision from the document alone.

Starting from operations, systems, or software

BLS says information security analysts typically need a bachelor's degree, and many have worked in an IT department, often as network and computer systems administrators. The postings keep the door wide. Notion says it is hiring across a range of experience levels and sets the bar at three or more years in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role. Anthropic's preferred qualifications list seven or more years of software engineering on equal footing with seven or more years of detection engineering, incident response or threat hunting.

Senior pay is wide. Replit lists a salary range of $230,000 to $360,000, and Vercel lists a San Francisco base pay range of $208,000 to $312,000. Not every opening is available to everyone, though. Databricks requires eligibility for a U.S. government Secret clearance, along with a bachelor's degree and seven or more years of incident response work, or a master's degree and five or more. Certifications weigh differently by employer: Replit lists GCIH, GCFA and GCFR as preferred while accepting equivalent hands-on experience.

Students can prepare by working the requirements backwards. Build a small lab that produces logs, write rules that catch attack traces in those logs, and put tests around the rules. Notion lists purple team, blue team and adversary emulation exercises that improved detections as a plus, and an exercise like that, written up clearly, is a line on a resume that shows the whole loop.