All remote jobs

AI Security Engineer, Detection and Response

AI Summary
Oura is hiring a senior AI Security Engineer for its Detection & Response team to build AI agents and automations for alert triage, investigation, detection engineering, and approved response actions. The role combines hands-on security operations, threat hunting, incident response, and digital forensics across endpoint, cloud, identity, and SaaS environments. Candidates need at least five years of cybersecurity experience, with strong Python, cloud, infrastructure-as-code, and LLM-agent integration capabilities. This is a US-based remote role, with a preference for East Coast candidates and optional access to offices or local coworking spaces. The position requires calm prioritization during incidents and clear communication with technical and leadership stakeholders.
Remote from
USA
Salary
USD 127,500–178k / yr
Department
Cybersecurity
Employment
Full Time
Experience
Open level
Published
Apply before
11 Dec 2026
Listing views
19
Application actions
1
Application toolkit

Make your next move.

Prepare your resume, explore your fit, and draft a cover letter for this opportunity.

Opportunity details

About this role.

Our mission at ŌURA is to empower every person to own their inner potential. Our award-winning products help our global community gain a deeper knowledge of their readiness, activity, and sleep quality by using their Oura Ring and its connected app. We’ve helped millions of people understand and improve their health by providing daily insights and practical steps to inspire healthy lifestyles.

Empowering the world starts with living our values and empowering our team. As a quickly growing company focused on helping people live healthier and happier lives, we ensure that our team members have what they need to do their best work — both in and out of the office.

Our mission at Ōura is to empower every person to own their inner potential. Our award-winning products help our global community gain a deeper knowledge of their readiness, activity, and sleep quality by using their Ōura Ring and its connected app. We’ve helped over a million people understand and improve their health by providing daily insights and practical steps to inspire healthy lives.Empowering the world starts with living our values and empowering our team. As a quickly growing company focused on helping people live healthier and happier lives, we ensure that our team members have what they need to do their best work – both in and out of the office.We are looking for an AI Security Engineer to join our Detection & Response team. You will focus on building AI agents and automations for security incident lifecycle, threat hunting, and detection engineering. Ōura is building an AI-native detection and response program, where agents investigate and resolve routine alerts and people focus on the hard calls. You will be hands-on in our environment, turning that plan into working solutions that protect our systems, data, and the members we serve.

What You Will Do:

  • Design, build, and deploy AI agents and automations that investigate and triage alerts, write and tune detections as code, enrich incidents, and take approved response actions to automate routine security operations.
  • Run AI-driven threat hunting, and turn gaps in visibility into new detection capabilities.
  • Conduct security incident response from detection through containment, eradication, recovery, and post-incident review, coordinating with engineering, IT, our managed SOC partners, and leadership.
  • Conduct investigations and digital forensics across endpoint, cloud, identity, and SaaS environments.

This is a remote role based in the US with a strong preference for candidates based on the East coast.

We have offices in San Francisco, San Diego and Los Angeles for those who prefer hybrid or office settings. Ōura employees in other major cities (like Boston and New York) occasionally gather informally at local co-working locations.

What you’ll bring:

  • Minimum 5 years of experience in cybersecurity, with a primary focus on security operations, detection engineering and incident response.
  • Proven experience leading incident investigations and digital forensics.
  • Hands-on experience writing and tuning detections in security detection solutions.
  • Hands-on experience building or integrating end-to-end AI agents and LLM-based solutions for security operations, such as alert triage, investigation, or automated response.
  • Scripting and automation skills in Python, and experience with cloud environments (AWS, Azure, GCP) and infrastructure as code.
  • You are organized, prioritize effectively, and stay calm under pressure, handling incidents alongside long-term build work.
  • Excellent communication, interpersonal, and collaboration skills with the ability to synthesize highly technical concepts into clear and concise language

Benefits

At Ōura, we care about you and your well-being. Everyone here at Ōura has a ring of their own and we are continually looking to improve employee health.

What we offer:

  • Competitive salary and equity packages
  • Health, dental, vision insurance, and mental health resources
  • An Ōura Ring of your own plus employee discounts for friends & family
  • 20 days of paid time off plus 13 paid holidays plus 8 days of flexible wellness time off
  • Paid sick leave and parental leave

Ōura takes a market-based approach to pay, which may vary depending on your location. US locations are categorized into tiers based on a cost of labor index for that geographic area. While most offers will be closer to the starting range, successful candidates’ pay will be determined based on job-related skills, experience, qualifications, work location, internal peer equity, and market conditions. These ranges may be modified in the future.

Region 1 $151,300 – $178,000
Region 2 $138,550 – $163,000
Region 3 $127,500 – 150,000

A recruiter can determine your Region based on your US location.

We are not considering candidates residing in the following states: Alaska (AK), Delaware (DE), Iowa (IA), Mississippi (MS), Nebraska (NE), South Dakota (SD), West Virginia (WV), and Wisconsin (WI).

ŌURA is proud to be an equal opportunity workplace. We celebrate diversity and are committed to creating an inclusive environment for all employees. Individuals seeking employment at ŌURA are considered without regard to age, ancestry, color, gender (including pregnancy, childbirth, or related medical conditions), gender identity or expression, genetic information, marital status, medical condition, mental or physical disability, national origin, protected family care or medical leave status, race, religion (including beliefs and practices or the absence thereof), sexual orientation, military or veteran status, or any other characteristic protected by federal, state, or local laws. We will not tolerate discrimination or harassment based on any of these characteristics.

We will work to ensure individuals with disabilities are provided reasonable accommodation to participate in the interview process, to perform essential job functions, and to receive other benefits and privileges of employment.

Disclaimer: Beware of fake job offers!
We’ve been alerted to scammers posing as ŌURA recruiters, especially for remote roles. Please note:

  • Our jobs are listed only on the ŌURA Careers page and trusted job boards.
  • We will never ask for personal information like ID or payment for equipment upfront.
  • Official offers are sent through Docusign after a verbal offer, not via text or email.

Stay cautious and protect your personal details.

To all recruitment agencies: ŌURA does not accept agency resumes. Please do not forward resumes to our jobs alias, ŌURA employees, or any other organization’s location. ŌURA is not responsible for any fees related to unsolicited resumes.

Apply now >

This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content.

Role DNA

A quick view of the complexity, pace, ownership and collaboration implied by the job description.

Job Complexity

5/5
EasyHard

Pace & Pressure

5/5
RelaxedFast-paced

Autonomy Level

5/5
GuidedFull ownership

Communication Load

4/5
IndependentCollaborative
AI insightThis is a senior, high-impact security role requiring deep incident-response expertise alongside practical AI-agent engineering. The engineer must make sound decisions under pressure while automating security actions safely across complex environments.

Salary analysis

Estimated compensation compared with the broader US market for similar roles.

Estimated job median (per year)Market rate
$152,750
US market range (per year)$145k–$190k
AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer discloses US market-based pay ranges from $127,500 to $178,000 USD. The yearly cadence is inferred from the magnitude of the disclosed base-pay ranges and the senior full-time US cybersecurity context, rather than explicitly stated. A reasonable estimated US market range for a senior AI security and detection-response engineer is $145,000 to $190,000 USD per year.

Core skills

Skills and capabilities most closely associated with this opportunity.

Sample interview questions
How would you design an AI agent to triage security alerts while limiting operational risk?

I would begin with read-only enrichment and classification tasks, using structured inputs, trusted tool access, confidence thresholds, and complete audit logging. The agent should escalate ambiguous or high-impact cases to an analyst and only execute pre-approved response actions through tightly scoped workflows with validation and rollback controls.

Describe your approach to turning a threat-hunting finding into a production detection.

I would validate the hypothesis against historical telemetry, define attacker behavior and expected false-positive patterns, and create a detection with clear severity, context, and investigation guidance. After testing in a monitored environment, I would tune it using analyst feedback, document ownership, and regularly review its effectiveness as attacker techniques and infrastructure change.

What evidence would you collect during an investigation involving a potentially compromised cloud identity?

I would review authentication events, MFA activity, IAM changes, token use, API calls, privileged actions, anomalous geolocation or device signals, and related endpoint and SaaS telemetry. I would preserve relevant logs, establish a timeline, identify affected resources, and coordinate containment such as session revocation, credential rotation, or temporary privilege restrictions.

How do you evaluate whether an LLM-based security automation is performing safely and effectively?

I would measure accuracy, false-positive and false-negative outcomes, escalation quality, action success rates, latency, and analyst time saved. Safety evaluation should include adversarial testing, prompt-injection resistance, least-privilege tool permissions, output validation, human approval for sensitive actions, and continuous review of logs and model behavior.

How would you communicate a significant security incident to engineering leaders and executives?

I would provide a concise, factual update covering what happened, affected systems or data, current business impact, containment status, known uncertainties, and the next decision points. I would tailor technical detail to the audience, maintain a regular update cadence, avoid speculation, and follow with a post-incident review containing root cause, corrective actions, owners, and timelines.

This analysis is generated from the job description. Salary estimates, role characteristics and sample answers are guidance, not employer-provided facts.
Next step

Apply now.

Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information.

Did you apply?Let us know, and we’ll help you track your application.

Continue on the employer website

Protect your personal information and never pay to secure an interview or job offer. .

Log in to save
One quick step before you apply

Sign in to continue.

Sign in or create a free account to continue to the employer's application.

Add alert
Jobs Talent AI Tools Salaries
Menu