Cloud Security Operations Engineer

This is a fully remote position, open to applicants in Mexico.

📋 Description

• Triage and thoroughly investigate alerts from start to finish across cloud-native tools, assessing severity and scope while concluding with well-documented findings.

• Identify and respond to cloud-specific threats, encompassing identity compromise, privilege escalation, abuse of access keys and tokens, exploitation of misconfigurations, and data exfiltration from cloud storage.

• Develop detection mechanisms based on cloud audit logs, network flow logs, and telemetry from containers and workloads.

• Conduct proactive threat hunting using methods aligned with ATT&CK, including the Cloud and Containers matrices.

• Create automation for cloud containment measures such as credential revocation, instance isolation, and policy quarantine.

• Lead incident response activities from initial scoping and containment through to post-incident reviews.

• Execute forensic analyses across cloud, host, network, and memory systems.

• Effectively communicate findings to both technical and non-technical stakeholders.

• Develop, refine, and maintain SIEM correlation rules and Sigma-based detection-as-code pipelines.

• Oversee the health and reliability of the SecOps tooling landscape, including SIEM, EDR, SOAR, and log ingestion pipelines.

• Ensure coverage, maintain integration uptime, and facilitate vendor escalation.

• Engage in the on-call rotation.

• Maintain operational runbooks.

• Participate in red and purple team exercises.

• Collaborate across functions with engineering and both technical and non-technical stakeholders.

⛳️ Requirements

• A minimum of 4 years of experience in security engineering, SOC operations (T2/T3), or incident response within a complex enterprise environment, with at least 3 years focused on securing production cloud workloads.

• Bachelor’s Degree (or equivalent experience) and/or 5 years of relevant experience.

• Comprehensive knowledge of cloud security architecture and telemetry from at least one major provider (AWS, Azure, or GCP), including the log sources necessary for effective detection and investigation.

• Profound understanding of cloud IAM and identity-based attack vectors, such as role assumption abuse, federation vulnerabilities, and long-lived credential compromises.

• Practical experience in investigating real cloud incidents using native cloud logs and forensic acquisition techniques.

• Familiarity with cloud-native threat detection services and the ingestion and normalization of cloud logs in a SIEM.

• Solid knowledge of core cloud infrastructure components: compute, storage, networking, and serverless technologies.

• Advanced skills with an enterprise SIEM, including authoring detections, creating correlation rules, pipeline management, and tuning processes to minimize false positives at scale.

• Proficient understanding of MITRE ATT&CK for mapping detections to technique coverage, identifying telemetry deficiencies, and designing hunts against specific adversary behaviors.

• Experience in digital forensics across host, network, and memory artifacts, including memory acquisition, disk imaging, and multi-source timeline correlation.

• Proficient in scripting with Python, PowerShell, or Bash, particularly in production automation, log enrichment, or tool integrations.

• Preferred experience with CSPM/CNAPP or cloud workload protection.

• Experience in multi-cloud environments is a plus.

• Preferred knowledge in container and Kubernetes security.

• Familiarity with Infrastructure as Code (IaC) for cloud guardrails and security configurations is advantageous.

• SOAR experience is preferred.

• Familiarity with detection-as-code workflows, CI/CD integration, and automated rule validation is a plus.

• Relevant professional certifications such as GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer are considered beneficial.

🏝️ Benefits

• Opportunities for career development and mentoring.

• An inclusive, fair, and transparent hiring process.

• Up to 10–20% travel for team meetings, training, or company events.

• Employment terms and benefits may be provided through an Employer of Record (EOR), where applicable.