Security Operations Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee security investigations and incident response from the initial assessment to containment, recovery, and closure.

• Evaluate endpoint telemetry, authentication activities, process execution, network connections, and other pertinent evidence.

• Execute authorized response actions and collaborate with system owners on remediation efforts.

• Escalate high-severity incidents and significant decisions impacting business or customers to Information Security leadership.

• Maintain timelines for investigations, document evidence, response decisions, and provide updates to stakeholders.

• Conduct post-incident reviews and monitor corrective actions until closure.

• Triage and resolve security tickets from Microsoft Defender, Palo Alto Cortex XDR, vulnerability assessments, employee reports, and internal escalations.

• Validate findings, assess risks, differentiate between malicious activity and benign behavior, and determine subsequent steps.

• Remediate findings within authorized access and change-control boundaries.

• Offer actionable guidance, establish ownership, track progress, and verify completion when other teams implement fixes.

• Document investigation results, evidence of remediation, and rationale for closure.

• Identify recurring issues and implement sustainable improvements.

• Take responsibility for endpoint vulnerability management, including prioritization, coordination of remediation, exception tracking, and verification.

• Maintain visibility into assessment coverage, identify missing or unhealthy agents, unsupported software, and unmanaged or outdated devices.

• Prioritize vulnerabilities based on severity, exploitability, exposure, and business criticality.

• Coordinate patch deployment and system changes with IT and infrastructure teams.

• Monitor remediation against service-level targets and escalate overdue high-risk findings.

• Validate fixes through reassessment or other technical evidence.

• Maintain documented, approved, time-bound exceptions.

• Report on coverage gaps, overdue exposure, remediation progress, and recurring challenges.

• Maintain and troubleshoot endpoint security policies, agent health, coverage, and integrations.

• Refine detections and recommend exclusions through documented review and approval.

• Develop scripts, investigative queries, dashboards, and integrations to minimize manual workload.

• Apply secure engineering practices, including least privilege, protected credentials, logging, testing, and safeguards for disruptive actions.

• Maintain response playbooks, technical documentation, and operational handoffs.

• Support targeted threat hunting and enhancements in security engineering.

• Collaborate with technical teams across a global organization to implement security improvements while considering availability and customer impact.

• Manage disruptive containment and remediation via incident and change management processes.

• Communicate technical findings to both technical and non-technical stakeholders.

• Participate in a shared on-call rotation with established escalation paths and backup coverage.

⛳️ Requirements

• A minimum of four years of relevant experience in one or more of the following: security operations, incident response, or security engineering.

• Proven ability to independently investigate security incidents and coordinate responses through to resolution.

• Experience in investigating Entra ID sign-in activities, Conditional Access, Intune-managed devices, and Exchange Online email threats.

• Hands-on experience with Microsoft Defender for Endpoint or Palo Alto Cortex XDR, with the capability to gain proficiency in both.

• Experience in managing endpoint vulnerability remediation, including prioritization, patch coordination, tracking, and verification.

• Strong Windows troubleshooting skills and a working knowledge of endpoint administration, identity security, and networking.

• Capability to interpret endpoint telemetry, process trees, authentication events, and operating system logs.

• Experience in managing findings through a ticketing or security case-management system.

• Practical scripting skills in PowerShell, Python, or Bash.

• Excellent written communication skills with the ability to provide actionable remediation guidance.

• Ability to prioritize competing demands and collaborate with teams across different time zones.

• Preferred: Production experience with both Microsoft Defender and Palo Alto Cortex XDR.

• Preferred: Experience with KQL, Cortex XDR query capabilities, or a SIEM platform.

• Preferred: Familiarity with endpoint management and patch deployment tools.

• Preferred: Experience in investigating or securing Linux or macOS systems.

• Preferred: Security operations experience in SaaS or other availability-sensitive environments.

• Preferred: Familiarity with cloud security logs and investigations.

• Preferred: Familiarity with EDI, managed file transfer, AS2, SFTP, APIs, or certificate management.

• Preferred: Relevant certifications (e.g., SC-200, GCIH, GCFA) or equivalent practical experience.

• Must be authorized to work for any employer in the U.S.

• Employment visa sponsorship is not available.

🏝️ Benefits

• Remote-first and casual work environment.

• 401k with a 3.5% company match, vested after 2 years.

• 20 PTO days.

• 10 company holidays.

• 1 birthday day off.

• 1 volunteer day.

• 3 summer days.

• Medical, dental, vision, and other life/health insurance plans.

• Paid parental leave.

• Wellness reimbursement program.

• Career development opportunities.

• Recognition programs.