# Senior Security Operations / Detection Engineer at LiteLLM

Senior Security Operations / Detection Engineer at LiteLLM in San Francisco. On-site, full-time, paying $220k–$280k. Posted November 5, 2026.

- Company: LiteLLM
- Location: San Francisco
- Workplace: On-site
- Job type: Full-time
- Pay: $220k–$280k
- Experience: 5+ years
- Posted: 2026-11-05
- Apply: https://jobs.ashbyhq.com/litellm/d1adbb67-7b1f-4daf-9863-d1c72069ba47/application
- Source: https://jobmagic.ai/jobs/senior-security-operations-detection-engineer-litellm-sa0k1m

## Requirements

- 5+ years of relevant experience.
- Experience building a detection and response function from scratch.
- Hands-on experience building and tuning SIEM detections, preferably in Splunk, and managing them as code.
- Experience building log pipelines from cloud and CI systems.
- Strong familiarity with GitHub, Okta, and cloud audit logs, including their limitations.
- Experience leading incidents end-to-end and making containment decisions on partial information.
- Understanding of OAuth, personal access tokens, OIDC, and how attackers abuse authentication systems.
- Ability to write Python scripts to investigate incidents and automate security operations.
- Strong independent judgment and experience owning priorities with limited oversight.
- Clear communication under pressure and a willingness to surface bad news early.
- Availability to overlap with Pacific working hours.

## Description

LiteLLM is an open-source AI Gateway that gives developers a unified interface to LLM providers. We’re looking for a Senior Security Operations / Detection Engineer to build and own detection and response across our infrastructure.

### About the role

You’ll own what we can see and how we respond: log pipelines, detections, runbooks, alert handling, and incident coordination.
This is a hands-on individual contributor role reporting to our security lead. You’ll work directly with engineering to build and operate a detection and response function suited to a small company. San Francisco is preferred.
You’ll own your roadmap, build and run the tooling yourself, and lead incidents with incomplete information. Strong written communication is essential: you’ll coordinate independently with engineers, customers, and vendors across time zones.

### Responsibilities

- Build and maintain security log pipelines and document coverage gaps.

- Build, validate, and tune detections across cloud infrastructure, CI systems, identity providers, and internal services.

- Manage detections as code, with clear documentation and ongoing maintenance.

- Write and maintain a runbook for every alert.

- Define severity-based alert response SLAs and own performance against them.

- Lead incidents from investigation and containment through recovery and follow-up.

- Produce clear incident timelines, reports, and recommendations.

- Measure and improve time to detect and contain threats.

- Automate detection of unexpected identity and access changes and drive remediation.

- Prioritize improvements based on risk and the needs of a small engineering organization.

### What we’re looking for

- 5+ years of relevant experience.

- Experience building a detection and response function from scratch.

- Hands-on experience building and tuning SIEM detections, preferably in Splunk, and managing them as code.

- Experience building log pipelines from cloud and CI systems.

- Strong familiarity with GitHub, Okta, and cloud audit logs, including their limitations.

- Experience leading incidents end-to-end and making containment decisions on partial information.

- Understanding of OAuth, personal access tokens, OIDC, and how attackers abuse authentication systems.

- Ability to write Python scripts to investigate incidents and automate security operations.

- Strong independent judgment and experience owning priorities with limited oversight.

- Clear communication under pressure and a willingness to surface bad news early.

- Availability to overlap with Pacific working hours.

### Bonus points

- You helped build a detection and response function at a growing technology company.

- Experience in managed detection and response or incident response across multiple customer environments.

- Experience partnering closely with engineers in a small, fast-moving team.

### Why join LiteLLM?

- Own detection and response across the environment, from collecting logs to leading incidents.

- Build a function around the needs of a small company.

- Work directly with security and engineering to close the gaps you find.

- Set priorities and implement improvements yourself.

### About LiteLLM

LiteLLM provides a unified API for LLM providers, along with routing, authentication, budgets, observability, and governance for production AI systems.