检测与响应工程师
Detection & Response Engineer
我们正在通过融合艺术与科学，构建能够模拟世界的 AI。
我们认为世界模型是人工智能进步的前沿。仅靠语言模型无法解决世界上最困难的问题——机器人技术、疾病、科学发现。真正的进步需要能够体验世界并从错误中学习的模型，就像人类一样。而这种试错过程在模拟环境中进行时，可以被大幅加速，而不是在现实世界中。
世界模型为通用模拟提供了最清晰的路径，改变故事的讲述方式、科学进步的方式以及人类下一个前沿领域的探索方式。
我们的团队由富有创造力、开放思维、富有同理心和雄心勃勃的人组成，他们决心改变世界。我们渴望不断创造不可能的事物，而我们实现这一目标的能力依赖于打造一支卓越的团队。如果你也渴望做到这一点，我们很期待收到你的消息。
### **关于该职位**
_支持远程办公 —— 我们在纽约、旧金山、西雅图、伦敦、巴黎和特拉维夫也有办公室。_
Runway 正在招聘一名检测与响应工程师，负责我们如何发现并阻止针对我们基础设施、研究环境和产品的攻击。
保护一家训练和提供前沿视频模型的公司，与保护一个典型的 SaaS 产品是不同的问题。该环境包括研究计算、大型训练数据集、快速移动的构建流程，以及每天使用 AI 辅助工具工作的工程师。这些因素都改变了攻击的表现形式，也改变了你需要看到什么才能发现它。
你将加入安全团队，以工程师的方式构建我们的检测与响应计划：检测作为代码，响应作为自动化，证据是可以查询的内容。这是一个具有真正所有权的角色：你将从头到尾负责检测计划，从我们记录的内容到事件关闭的速度。你将向安全负责人汇报，与平台和研究部门的工程师合作，并塑造这个职能未来的发展方向。
### 你将负责
- 全面负责检测与响应：我们记录什么，我们警报什么，我们如何分类和恢复
- 在多个云环境、Kubernetes、身份系统、终端和 SaaS 中编写和调整检测逻辑，并根据覆盖率和准确性而非警报数量来衡量
- 从第一个警报开始领导事件响应，直至遏制和取证，
查看英文原文
We are building AI to simulate the world through merging art and science.
We believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems – robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world.
World models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached.
Our team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you.
### **About the role**
_Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv._
Runway is hiring a Detection & Response Engineer to own how we find and stop attacks against our infrastructure, our research environment and our products.
Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what you need to see to catch it.
You'll join the Security team and build our detection and response program the way an engineer would: detections as code, response as automation, evidence as something you can query. This is a role with real ownership: you'll own the detection program end to end, from what we log to how quickly we close an incident. You'll report to the head of security, partner with engineers across platform and research, and shape how this function grows from here.
### What you'll do
- Own detection and response end to end: what we log, what we alert on, how we triage and how we recover
- Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume
- Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read
- Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit
- Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls
- Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one
- Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find
- Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team
- Participate in an on-call rotation for security incidents
### What you'll need
- Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward
- Experience building and tuning detections in a modern SIEM, ideally managed as code
- Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs
- Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools
- Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity
- Clear writing. Incident timelines, detection documentation and updates to leadership are all part of the job
- Judgment about what to alert on, what to automate and when to wake someone up
### Even better if you have
- Experience monitoring GPU or HPC-style infrastructure, or research environments with large datasets
- Experience building detections or guardrails for AI agents, LLM tooling or MCP servers
- Cloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custody
- Published open source detection content
Runway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide.
There are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range.
Lastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates.
#### **Working at Runway**
[**Great things come from great teams.**](https://www.youtube.com/watch?v=kwmj4ato2kw&ab_channel=Runway) **We’d love to hear from you.**
We’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply.
More about Runway
- [Universal World Simulator](https://runwayml.com/world-simulator.html)
- [GWM-1](https://runwayml.com/research/introducing-runway-gwm-1)
- [Gen-4.5](https://runwayml.com/research/introducing-runway-gen-4.5)
- [General World Models](https://runwayml.com/research/introducing-general-world-models)
- [Robotics SDK](https://runwayml.com/research/introducing-runway-gwm-1#robotics-section)
- [Conversational Real-time Agents](https://runwayml.com/research/introducing-runway-gwm-1#avatars-section)
- [Runway Studios](https://runwayml.com/studios)
We're excited to be recognized as a best place to work:
[Crain's](https://www.crainsnewyork.com/awards/best-places-work-2023) | [InHerSight](https://www.inhersight.com/companies/best/city/new-york-city-ny) | [BuiltIn NYC](https://builtin.com/awards/new-york-city/2024/best-places-to-work) | [INC](https://www.inc.com/best-workplaces/2024)