Material Security provides phishing protection, account takeover prevention, and email DLP for Google Workspace and Microsoft 365. Backed by South Park Commons and Amplify.
About the role
Detection and Response (own) : Own corporate telemetry and the detection content on it. Close coverage gaps, reduce noise with measured fidelity, and build detections for what matters here: account takeover, session token theft, malicious OAuth grants, admin abuse, and exfiltration by someone who legitimately has access. Lead corporate incident response and own the playbooks. Found on 1752vc Careers, the job board for startup and VC roles.
What they're looking for
- You have owned a corporate stack end to end — devices, identity, SaaS, collaboration — and turned controls that were deployed into controls that are enforced
- You treat the IdP, the device fleet, and the SaaS estate as one system, and you harden the paths between them rather than each tool in isolation
- You have written detections that caught real attacks and removed the noise that buried the team, and you can explain how you measured the difference
- You have responded to live incidents and made the containment call. You know what to revoke first
- When a job requires someone to do something manually and repetitively, your instinct is to build the system that makes that job unnecessary
- You have put an LLM into a security workflow, measured it, and have specific views about where it should and should not be trusted
More about this role
Material works with some of the most sophisticated security teams in the industry. These customers have entrusted us with protecting one of their most critical assets: Google Workspace. Your mission is to make our own corporate environment worthy of that trust: take a mature security program and make it rigorous, measured, and adapted to the new generation of LLM-based security tooling. Success means we can detect and defend against sophisticated attacks. This includes hardening our corp services, increasing detection efficacy while reducing response times, and making sure our employees are working with customer data in ways that reflect the trust of our customers
Concretely: bring your experience to identify and close gaps in our environment, rebuild our detection and response around LLMs — and be customer zero for our own product, working with Engineering to turn what you learn into detection improvements that ship to every customer.
The environment is what you’d expect at a modern startup: Mac-only fleet, Google Workspace, expected security services like a SIEM, IdP, EDR, fleet management and a cloud production environment. Our security posture is more mature than typical for a...
Browse similar: Startup jobs · Remote jobs