Security Operations Engineer

This is a fully remote position, open to applicants in North America.

📋 Description

• Take charge of the daily operations and ongoing enhancement of Alpaca’s SIEM and SOAR capabilities.

• Integrate security logs from cloud, identity, endpoint, SaaS, and application systems, ensuring proper parsing, normalization, and data quality validation.

• Create, test, and optimize detection rules informed by threat intelligence, incident insights, and new attack strategies, aligned with frameworks like MITRE ATT&CK.

• Adjust, enrich, and manage the lifecycle of detections to ensure alerts remain actionable.

• Maintain detections for essential systems and prioritized attack techniques.

• Develop and sustain dashboards to monitor alert volume, ingest health, and response status.

• Assist with security incidents through evidence collection, detection queries, and containment strategies.

• Enhance and refine alert-handling procedures and incident response runbooks along with escalation pathways.

• Monitor and report on security operations metrics, including MTTD and MTTR.

• Engage in the Security Operations on-call rotation following onboarding and cross-training.

• Design, construct, and maintain SOAR playbooks to automate enrichment, containment, ticketing, and notifications.

• Assess, investigate, and respond to security alerts across endpoints, identity, cloud, network, and application logs.

• Conduct hypothesis-driven threat hunts and convert findings into new detection methods.

• Report directly to the Enterprise Security Architect and collaborate with Security, IT, DevOps, Engineering, and external partners.

⛳️ Requirements

• A minimum of 3 years of experience in Security Operations or detection engineering roles.

• Practical experience in operating and tuning a SIEM.

• Proven experience in creating SOAR playbooks or equivalent automation for response.

• Proficient in working with Linux environments.

• Experience with scripting or automation (Python, Bash) for security operations tasks.

• Familiarity with onboarding and parsing log sources from cloud, identity, and SaaS platforms.

• Strong skills in alert investigation across identity, endpoint, network, and cloud environments.

• Knowledge of common attacker techniques and detection methodologies.

• Experience in supporting security incidents, including evidence gathering, detection queries, and containment actions.

• Willingness to participate in an on-call rotation.

• Excellent written and verbal communication skills, particularly during incidents.

• Comfortable working collaboratively across functions and managing escalations calmly and decisively.

• Experience in securing financial, trading, or other highly regulated platforms.

• Familiarity with compliance frameworks such as SOC 2 or ISO 27001.

• Experience with detection-as-code, GitOps, and CI/CD pipelines.

• Understanding of cloud security logging (AWS/GCP/Azure) and SaaS security telemetry.

• Familiarity with Kubernetes-hosted security tools.

• Experience collaborating with a managed SOC or MSSP.

• Possession of security certifications (GCIA, GCIH, GCED, or similar).

• Ability to balance security rigor with operational efficiency and business requirements.

🏝️ Benefits

• Competitive Salary & Stock Options.

• Health Benefits.

• New Hire Home-Office Setup: One-time USD $500.

• Monthly Stipend: USD $150 per month via a Brex Card.