Threat Detection and Response Engineering Manager

Details

About the Team

OpenAI’s mission depends on developing and deploying powerful AI responsibly. Security makes that possible by protecting research, people, products, and users while enabling progress. Security defends sensitive research and other intellectual property, customer data, and the infrastructure behind frontier AI, including GPU supercomputing, multicloud environments, datacenters, and emerging agent systems. Threat Detection Engineering builds and operates detections and investigative workflows that turn adversary activity into effective response.

About the Role

OpenAI is looking for a hands-on technical leader to guide engineers who identify and investigate threats and build capabilities to contain them. The role involves hiring and developing engineers, setting technical direction, and prioritizing risks to OpenAI’s intellectual property, customer data, and critical infrastructure.

The team will take an agent-first approach across the detection and response lifecycle, using OpenAI’s models to develop detections, triage signals, investigate suspicious activity, and support bounded response and continuous improvement. The manager will turn advances in model capability into dependable defenses, own their effectiveness, and work with security, research, and infrastructure partners to ensure findings lead to effective action. The role includes establishing where agents can act independently and where human judgment and approval are essential.

Responsibilities

• Hire, coach, and develop engineers; set expectations, provide feedback, grow technical leadership, and build a team that rigorously reviews work and learns from missed detections and noisy signals.
• Set a threat-informed roadmap covering systems used to train and evaluate frontier models, production inference services, datacenter hardware and networks, and employee devices, identities, and applications.
• Own detection and investigation as a complete workflow, including agent-driven triage and investigation. Escalate findings warranting formal incident response to the Security Incident Response Team (SIRT) and support SIRT-led investigations.
• Build and test response and containment capabilities tailored to OpenAI’s infrastructure, defining when human approval is required and how to verify containment.
• Apply OpenAI’s models to threat hypothesis development, detection authoring and testing, deployment, tuning, and the incorporation of investigation findings into improved coverage.
• Prototype new approaches using OpenAI’s models, evaluate them against realistic adversary behavior and analyst baselines, and move successful experiments into production.
• Use operational evidence to identify model limitations and partner with Research and Engineering to address them.
• Translate adversary intelligence and incident findings into testable detection hypotheses, including risks specific to a frontier AI lab and increasingly capable agents operating across systems with access to sensitive research.
• Partner with Security Observability and infrastructure owners to define telemetry and forensic data requirements and improve missing evidence, unreliable data, or limited controls.
• Use replay, adversarial validation, and regression testing to measure workflow effectiveness. Establish code review, documentation, staged rollout, monitoring, and rollback practices.
• Measure coverage, investigation accuracy, time to identify threats, and response effectiveness.
• Contribute investigative expertise during incidents and use incident findings to improve detections.

Requirements

• Experience managing security or software engineers, including hiring, coaching, developing technical judgment, and improving team delivery.
• Hands-on ability to prototype tools, write and review code, and guide engineers through complex detection, investigation, and response designs.
• Strong AI fluency and experience building systems that test how models or agents can improve cyber defense.
• Experience evaluating real security workflows against meaningful baselines, understanding model failure modes, and designing reliable workflows with bounded permissions and clear human decision points.
• Experience building or operating threat detections and leading technical investigations.
• Understanding of adversary tradecraft and the ability to assess evidence, scope, and uncertainty across complex environments.
• Understanding of how identity, endpoint, cloud, Kubernetes, and infrastructure telemetry supports investigations.
• Ability to reason about response and containment in unfamiliar systems and work with system owners to build practical capabilities.
• Experience using testing and operational feedback to improve security outcomes and balancing coverage, accuracy, speed, and human workload.
• Ability to build focused roadmaps and strong cross-functional partnerships in a rapidly changing environment.

Benefits

• Base salary of $401,000–$510,000 USD, plus equity.
• Medical, dental, and vision insurance, with employer contributions to Health Savings Accounts.
• Pre-tax accounts for health, dependent care, and commuter expenses.
• 401(k) retirement plan with employer match.
• Paid parental, medical, and caregiver leave.
• Paid time off, company holidays, office closures, and paid sick or safe time as required by law.
• Mental health and wellness support.
• Employer-paid basic life and disability coverage.
• Annual learning and development stipend.
• Daily office meals and eligible meal delivery credits.
• Relocation support for eligible employees.
• Additional benefits may include charitable donation matching and wellness stipends.