Security Engineer (Detection & Response)

The Security team at Headway is responsible for the security and privacy of all of Headway's customers — therapists, patients, and payer partners (insurance companies and health systems). As a Security Engineer on our Detection & Response team, you'll help build the capabilities we use to identify, respond to, and contain potential threats across our production and corporate environments — ensuring our logging is adequate and accessible, our detections cover real-time monitoring and alerting, and our incident response is well-documented and well-rehearsed.

This role scales alongside the volume of data our business generates and consumes, and alongside our ambition to work smarter — not just harder — by applying automation and AI where it genuinely helps, and knowing when it doesn't.

What you'll do at Headway:

• Detection engineering: Build and refine detections, logging/telemetry coverage, and tooling (SIEM/ETL pipeline refinement) so we have real-time visibility into anomalous and malicious activity across cloud, corporate, and SaaS environments.
• Incident response engineering: Run incident response activities, threat hunting, and threat modeling — and continuously improve our processes and documentation so the team gets faster and sharper after every incident.
• AI security tooling and automation: Implement automation and AI where it's the right tool for the job — and push back when it isn't. You'll help define what "AI-forward" detection and response looks like at Headway without over-rotating on it.
• Security alert triage: Triage security alerts and build deep familiarity with our environment so you can separate signal from noise quickly.
• Team contributions: Participate in the security on-call rotation, author runbooks, contribute to security education and partnership across engineering, and mentor peers.
• Documentation: Keep detections, logging capabilities, runbooks, response processes, and threat intel well-documented so knowledge compounds across the team.
• Languages: Python 3, TypeScript
• Infrastructure: AWS (Fargate, ECS, S3, and more)
• Datastores: PostgreSQL, Snowflake
• Monitoring & Response: Datadog, PagerDuty
• Version Control: GitHub
• Security Tooling: Anthropic, Wiz, Semgrep, Datadog, Tines

…