Senior Security Operations Engineer

This is a fully remote position, open to applicants in United States, +2 more countries.

📋 Description

• Take charge of detection engineering and threat hunting within CrowdStrike Next-Gen SIEM, which includes onboarding log sources and tuning detections.

• Develop security automation and SOAR workflows that link identity, endpoint, email, and SaaS tools.

• Leverage AI agents and automated workflows for triage, investigation, enrichment, and response.

• Act as the technical lead for corporate incident response, addressing third-party and supply-chain events.

• Conduct forensic investigations, identify root causes, provide guidance to leaders and staff, and maintain incident runbooks.

• Participate in the escalation rotation and support the Incident Commander as required.

• Manage CrowdStrike Falcon configurations, detections, device trust checks, software inventories, and escalations related to Falcon Complete.

• Oversee Okta authentication, MFA, session policies, privileged access management, access reviews, and automation of audit evidence.

• Supervise Mimecast, secure network access, Google Workspace, critical SaaS security settings, and findings related to SaaS security posture.

• Ensure data loss prevention across email, Google Workspace, endpoints, and SaaS applications.

• Manage security for Fleetio’s AI application, focusing on AI-tool visibility, agent identity and access management, guardrails, and AI detection and response.

• Execute vulnerability management for corporate assets and provide clear metrics on security posture.

• Collaborate with IT Operations, Compliance, the third-party SOC, and Product Security.

⛳️ Requirements

• 5+ years of experience in security operations, detection and response, or security engineering, preferably within a SaaS environment.

• Proficient in detection engineering and threat hunting within a SIEM (CrowdStrike Next-Gen SIEM or comparable).

• Experience in security automation, including the creation of SOAR playbooks (CrowdStrike Fusion or similar) that integrate identity, endpoint, email, and SaaS tools into a cohesive response process, utilizing Python, PowerShell, and REST APIs.

• Comprehensive incident response skills, from initial triage to forensic analysis, root cause identification, and follow-up across cloud, identity, and SaaS platforms, including collaboration with an MDR or managed SOC provider.

• Knowledge of identity security using Okta or a similar provider, including authentication policies, privileged access, and access reviews within a SOC 2 or ISO 27001 control framework.

• Proficient in endpoint security with CrowdStrike or a similar tool, covering macOS, device trust, and endpoint query tools.

• Familiarity with email security (Mimecast or similar) and SaaS security posture management.

• Experience in designing and managing a DLP program, including data classification, policy design and adjustments across email, cloud collaboration, and endpoints, as well as investigating data exposure incidents.

• Knowledge of securing developer tools and the software supply chain (IDE extensions, package registries, AI coding tools).

• Exceptional written and verbal communication skills, especially in articulating risk to non-technical leaders.

🏝️ Benefits

• Multiple health/dental coverage options (100% coverage for employees, 50% for family members).

• Vision insurance.

• Incentive stock options.

• 401(k) match of 4%.

• PTO - 4 weeks (increasing after two years!).

• 12 company holidays plus 2 floating holidays.

• Parental leave - birthing parent (16 weeks paid) and non-birthing parent (4 weeks paid).

• FSA & HSA options.

• Short and long-term disability (short term coverage 100% paid).

• Community service funds.

• Professional development funds.

• Wellbeing fund - $150 quarterly.

• Business expense stipend - $125 quarterly.

• Mac laptop and new hire equipment stipend.

• Fully stocked kitchen with a variety of drinks and snacks (BHM only).

• Remote work friendly since 2012.