Security Operations Engineer

This is a fully remote position, open to applicants in California, +1 more state.

📋 Description

• Develop, refine, and oversee high-confidence detection systems spanning AWS, GCP, Okta, GWS, M365, and various vendor products.

• Manage detections as code by utilizing version control, peer reviews, continuous integration testing, and evaluations against MITRE ATT&CK.

• Act as a senior incident responder for security events, leading triage, containment, forensic analysis, and remediation efforts.

• Write post-incident reports and translate findings into sustainable enhancements.

• Execute proactive threat hunts across cloud, SaaS, identity, and on-premises environments.

• Design and create automation and SOAR playbooks to minimize manual tasks and expedite responses.

• Oversee and enhance security data pipelines, which include onboarding log sources, ensuring parser and schema quality, conducting coverage analysis, and maintaining data integrity.

• Integrate automation solutions for identifying, prioritizing, and remediating vulnerabilities.

• Collaborate with infrastructure, platform, and engineering teams on security operations needs and cloud architectural decisions.

• Participate in a shared on-call rotation and enhance runbooks, escalation pathways, and alert efficacy.

• Promote company policies, including safety, attendance, and security protocols.

⛳️ Requirements

• Minimum of 5 years in security operations, incident response, or detection engineering roles.

• At least 2 years of experience in a senior position within a cloud-native environment.

• Extensive hands-on experience securing AWS at scale, focusing on IAM, CloudTrail, GuardDuty, Security Hub, EC2, EKS, and Lambda.

• Familiarity with GCP or Azure is advantageous.

• Strong proficiency with SIEM tools, including the ability to build and refine detections, craft complex queries, and manage log pipelines.

• Proficient in one or more general-purpose programming or scripting languages, preferably Python.

• Experience in developing automation, integrations, and SOAR playbooks from the ground up.

• Skilled incident responder capable of leading under pressure and effectively communicating with both technical and executive audiences.

• Knowledge of MITRE ATT&CK and cloud-specific attack vectors.

• Experience in influencing engineering roadmaps, negotiating with vendors, and representing security operations in cross-departmental discussions.

• Exceptional problem-solving skills with the ability to work independently and manage multiple tasks simultaneously.

• Familiarity with compliance frameworks such as PCI, NIST, ISO, and SOX, along with experience assisting in audits.

• Candidates must be authorized to work within the United States.

🏝️ Benefits

• Medical, Dental, and Vision insurance.

• Fertility assistance.

• Commuter assistance.

• Educational assistance.

• Competitive 401k matching plan.

• Flexible time-off policy for salaried employees.

• Ten company-paid holidays.

• Discounts on select grading services for approved submissions.

• Flexible work schedules with varying shifts.

• Celebrations, holiday events, and team-building activities.