Senior Security Engineer - Detection & Response

EvenUp is on a mission to close the justice gap using technology and AI. We empower personal injury lawyers and victims to get the justice they deserve. Our products enable law firms to secure faster settlements, higher payouts, and better outcomes for victims injured through no fault of their own in vehicle collisions, accidents, natural disasters, and more.

We are one of the fastest-growing vertical SaaS companies in history, and we are just getting started. EvenUp is backed by top VCs, including Bessemer Venture Partners, Bain Capital Ventures, SignalFire, and Lightspeed. We are looking to expand our team with talented, driven, and collaborative individuals who seek to have a lasting impact. Learn more at www.evenuplaw.com.

We're looking for a hands-on Senior Security Engineer to build our detection and response program: the telemetry pipelines, the SIEM, the detection content, and the incident response muscle behind them. You won't inherit a SOC — you'll design one.

This isn't a role where you'll stare at a queue of vendor alerts. The threats that matter most to us don't come out of any box: they live in our own applications and data flows, and detecting them means partnering with the engineers who build those systems. We believe security should accelerate the business, not slow it down. If you're excited about treating detection as an engineering discipline, we'd love to chat.

• Build the program, not just the rules: select the SIEM, design the telemetry architecture, and write the first generation of detections; your technical decisions become the foundation.

• Detect what actually matters: focus on highest-stakes risks unique to our business, like sensitive data moving to the wrong place, misuse of internal systems, and exposure of health information, as generic detection content cannot address these.

• Detection as code: detections are written, version-controlled, tested, and reviewed like software.

• Own incident response: define how EvenUp responds to incidents, including playbooks, tabletop exercises, and post-incident reviews.

• Direct the vendors, don't answer to them: when using managed providers for 24/7 coverage, you set the requirements, escalation logic, and quality standards.

• →

#LI-Hybrid