diff --git a/.buildkite/pipelines/pull_request/response_ops.yml b/.buildkite/pipelines/pull_request/response_ops.yml
new file mode 100644
index 0000000000000..846477170409b
--- /dev/null
+++ b/.buildkite/pipelines/pull_request/response_ops.yml
@@ -0,0 +1,11 @@
+steps:
+  - command: .buildkite/scripts/steps/functional/response_ops_cases.sh
+    label: 'Cases Cypress Tests on Security Solution'
+    agents:
+      queue: ci-group-6
+    depends_on: build
+    timeout_in_minutes: 120
+    retry:
+      automatic:
+        - exit_status: '*'
+          limit: 1
diff --git a/.buildkite/scripts/pipelines/pull_request/pipeline.js b/.buildkite/scripts/pipelines/pull_request/pipeline.js
index 2d3befd00a890..fa167d9f324b4 100644
--- a/.buildkite/scripts/pipelines/pull_request/pipeline.js
+++ b/.buildkite/scripts/pipelines/pull_request/pipeline.js
@@ -65,7 +65,6 @@ const uploadPipeline = (pipelineContent) => {
     if (
       (await doAnyChangesMatch([
         /^x-pack\/plugins\/security_solution/,
-        /^x-pack\/plugins\/cases/,
         /^x-pack\/plugins\/lists/,
         /^x-pack\/plugins\/timelines/,
         /^x-pack\/test\/security_solution_cypress/,
@@ -77,6 +76,13 @@ const uploadPipeline = (pipelineContent) => {
       pipeline.push(getPipeline('.buildkite/pipelines/pull_request/security_solution.yml'));
     }
 
+    if (
+      (await doAnyChangesMatch([/^x-pack\/plugins\/cases/])) ||
+      process.env.GITHUB_PR_LABELS.includes('ci:all-cypress-suites')
+    ) {
+      pipeline.push(getPipeline('.buildkite/pipelines/pull_request/response_ops.yml'));
+    }
+
     if (
       (await doAnyChangesMatch([/^x-pack\/plugins\/apm/])) ||
       process.env.GITHUB_PR_LABELS.includes('ci:all-cypress-suites')
diff --git a/.buildkite/scripts/steps/functional/response_ops_cases.sh b/.buildkite/scripts/steps/functional/response_ops_cases.sh
new file mode 100755
index 0000000000000..13d0ef52130a3
--- /dev/null
+++ b/.buildkite/scripts/steps/functional/response_ops_cases.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/scripts/steps/functional/common.sh
+
+export JOB=kibana-security-solution-chrome
+
+echo "--- Response Ops Cases Cypress Tests on Security Solution"
+
+cd "$XPACK_DIR"
+
+checks-reporter-with-killswitch "Response Ops Cases Cypress Tests on Security Solution" \
+ node scripts/functional_tests \
+   --debug --bail \
+   --kibana-install-dir "$KIBANA_BUILD_LOCATION" \
+   --config test/security_solution_cypress/cases_cli_config.ts
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/attach_to_case.spec.ts b/x-pack/plugins/security_solution/cypress/integration/cases/attach_alert_to_case.spec.ts
similarity index 100%
rename from x-pack/plugins/security_solution/cypress/integration/detection_alerts/attach_to_case.spec.ts
rename to x-pack/plugins/security_solution/cypress/integration/cases/attach_alert_to_case.spec.ts
diff --git a/x-pack/plugins/security_solution/package.json b/x-pack/plugins/security_solution/package.json
index a899f5948c780..fb0a9a7ed1d78 100644
--- a/x-pack/plugins/security_solution/package.json
+++ b/x-pack/plugins/security_solution/package.json
@@ -13,6 +13,7 @@
     "cypress:open-as-ci": "node ../../../scripts/functional_tests --config ../../test/security_solution_cypress/visual_config.ts",
     "cypress:open:upgrade": "yarn cypress:open --config integrationFolder=./cypress/upgrade_integration",
     "cypress:run": "yarn cypress:run:reporter --browser chrome --spec './cypress/integration/**/*.spec.ts'; status=$?; yarn junit:merge && exit $status",
+    "cypress:run:cases": "yarn cypress:run:reporter --browser chrome --spec './cypress/integration/cases/*.spec.ts'; status=$?; yarn junit:merge && exit $status",
     "cypress:run:firefox": "yarn cypress:run:reporter --browser firefox --spec './cypress/integration/**/*.spec.ts'; status=$?; yarn junit:merge && exit $status",
     "cypress:run:reporter": "yarn cypress run --config-file ./cypress/cypress.json --reporter ../../../node_modules/cypress-multi-reporters --reporter-options configFile=./cypress/reporter_config.json",
     "cypress:run:ccs": "yarn cypress:run:reporter --browser chrome --config integrationFolder=./cypress/ccs_integration; status=$?; yarn junit:merge && exit $status",
diff --git a/x-pack/test/security_solution_cypress/cases_cli_config.ts b/x-pack/test/security_solution_cypress/cases_cli_config.ts
new file mode 100644
index 0000000000000..90fec2404e6f0
--- /dev/null
+++ b/x-pack/test/security_solution_cypress/cases_cli_config.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+import { SecuritySolutionCypressCliCasesTestRunner } from './runner';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const securitySolutionCypressConfig = await readConfigFile(require.resolve('./config.ts'));
+  return {
+    ...securitySolutionCypressConfig.getAll(),
+
+    testRunner: SecuritySolutionCypressCliCasesTestRunner,
+  };
+}
diff --git a/x-pack/test/security_solution_cypress/runner.ts b/x-pack/test/security_solution_cypress/runner.ts
index b537be4e80b41..21404b8b2e47f 100644
--- a/x-pack/test/security_solution_cypress/runner.ts
+++ b/x-pack/test/security_solution_cypress/runner.ts
@@ -38,6 +38,33 @@ export async function SecuritySolutionCypressCliTestRunner({ getService }: FtrPr
   });
 }
 
+export async function SecuritySolutionCypressCliCasesTestRunner({
+  getService,
+}: FtrProviderContext) {
+  const log = getService('log');
+  const config = getService('config');
+  const esArchiver = getService('esArchiver');
+
+  await esArchiver.load('x-pack/test/security_solution_cypress/es_archives/auditbeat');
+
+  await withProcRunner(log, async (procs) => {
+    await procs.run('cypress', {
+      cmd: 'yarn',
+      args: ['cypress:run:cases'],
+      cwd: resolve(__dirname, '../../plugins/security_solution'),
+      env: {
+        FORCE_COLOR: '1',
+        CYPRESS_BASE_URL: Url.format(config.get('servers.kibana')),
+        CYPRESS_ELASTICSEARCH_URL: Url.format(config.get('servers.elasticsearch')),
+        CYPRESS_ELASTICSEARCH_USERNAME: config.get('servers.elasticsearch.username'),
+        CYPRESS_ELASTICSEARCH_PASSWORD: config.get('servers.elasticsearch.password'),
+        ...process.env,
+      },
+      wait: true,
+    });
+  });
+}
+
 export async function SecuritySolutionCypressCliFirefoxTestRunner({
   getService,
 }: FtrProviderContext) {