Security Engineer (Detection & Response)

About the role

The Security team at Headway is responsible for the security and privacy of all of Headway's customers — therapists, patients, and payer partners (insurance companies and health systems). As a Security Engineer on our Detection & Response team, you'll help build the capabilities we use to identify, respond to, and contain potential threats across our production and corporate environments — ensuring our logging is adequate and accessible, our detections cover real-time monitoring and alerting, and our incident response is well-documented and well-rehearsed.

This role scales alongside the volume of data our business generates and consumes, and alongside our ambition to work smarter — not just harder — by applying automation and AI where it genuinely helps, and knowing when it doesn't.

What you'll do at Headway:

• Detection engineering: Build and refine detections, logging/telemetry coverage, and tooling (SIEM/ETL pipeline refinement) so we have real-time visibility into anomalous and malicious activity across cloud, corporate, and SaaS environments.

• Incident response engineering: Run incident response activities, threat hunting, and threat modeling — and continuously improve our processes and documentation so the team gets faster and sharper after every incident.

• AI security tooling and automation: Implement automation and AI where it's the right tool for the job — and push back when it isn't. You'll help define what "AI-forward" detection and response looks like at Headway without over-rotating on it.

• Security alert triage: Triage security alerts and build deep familiarity with our environment so you can separate signal from noise quickly.

• Team contributions: Participate in the security on-call rotation, author runbooks, contribute to security education and partnership across engineering, and mentor peers.

• Documentation: Keep detections, logging capabilities, runbooks, response processes, and threat intel well-documented so knowledge compounds across the team.

Tools we use:

• Languages: Python 3, TypeScript

• Infrastructure: AWS (Fargate, ECS, S3, and more)

• Datastores: PostgreSQL, Snowflake

• Monitoring & Response: Datadog, PagerDuty

• Version Control: GitHub

• Security Tooling: Anthropic, Wiz, Semgrep, Datadog, Tines

You’ll be great for this role if you have:

• Dedicated experience of 1-2+ years with responsibilities related to security response and automation OR a security-adjacent engineering background

• 4-5+ years in related areas — DevOps, IT, software engineering, or similar with concrete security responsibilities or overlap. Comfortable scripting/coding to build and automate your own tooling.

• SIEM/observability experience: You've worked with logging, detection, or observability platforms in a cloud or distributed environment. The specific stack matters less than your understanding and approach.

• Sound judgment on AI and automation: You're willing to implement AI and automation where it helps, and just as willing to recognize when a deterministic tool — or a human — is the better call.

• Comfort with high autonomy: You thrive in an async, high-autonomy environment and can prioritize your own work without a lot of hand-holding.

• Strong cross-functional collaboration: You work well with technical and non technical teams to understand detection and response needs and keep several projects moving at once.

• Mission driven: You're motivated by Headway's mission of increasing access to high-quality mental healthcare.

Nice to have (optional, not required):

• Experience in a regulated environment (e.g. healthcare, finance, federal)

• Experience with automation/SOAR tooling

• Detection-as-Code or Infrastructure-as-Code experience

• A track record of prioritizing and shipping risk-based detections, running threat modeling, or building alert pipelines