Staff Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Create and sustain high-fidelity threat detection content across infrastructure, endpoint, cloud, SaaS, and identity platforms.

• Take ownership of and enhance detection engineering workflows, which include testing, tuning, minimizing false positives, and conducting coverage analysis.

• Collaborate with the external MDR provider to establish and refine detection rules, enhance investigation quality, and set up escalation and response workflows.

• Support and engage in incident response activities, covering investigation, containment, eradication, and post-incident reviews.

• Construct dashboards, metrics, and reports to assess detection coverage, SOC effectiveness, and overall security posture.

• Oversee and secure AWS and cloud-native environments, including monitoring CloudTrail, VPC Flow Logs, workload logs, and SaaS integrations.

• Assess and implement AI-assisted security features for defense and detection purposes.

• Specify how AI systems, agents, and their usage are logged, monitored, and evaluated for risk.

• Produce documentation, runbooks, and operational playbooks for SOC and security engineering processes.

• Mentor junior engineers and provide technical guidance within SOC and security engineering roles.

• Keep abreast of emerging threats, detection methodologies, attacker tactics, and best practices in security data engineering.

⛳️ Requirements

• Over 8 years of experience in security engineering, security operations, detection engineering, or incident response.

• Extensive hands-on experience in developing, testing, and fine-tuning SIEM and EDR detections across various environments.

• Strong foundation in threat detection and incident response within a SOC setting.

• Experience managing open-source threat intelligence platforms such as MISP, Yeti, and OpenCTI.

• Proven ability to enhance alert quality, reduce false positives, and integrate business context into detection and response strategies.

• Experience collaborating with external MDR providers, managed SOCs, or SIEM service partners.

• Solid incident response background, including leading technical investigations and managing containment, eradication, and recovery efforts.

• Practical experience with EDR platforms.

• Familiarity with identity and access logs.

• Experience investigating threats in AWS environments and utilizing cloud security telemetry.

• Understanding of AI and machine-learning applications in security, covering detection, automation, and governance considerations.

• Strong written and verbal communication skills, including the ability to produce threat intelligence assessments and reports.

• Capability to work both independently and collaboratively in a dynamic environment.

• Familiarity with detection engineering frameworks such as the Diamond Model and MITRE ATT&CK.

• Experience in healthcare, biotech, or other regulated sectors.

• Possession of security certifications like CISSP, GIAC, GCED, GCIA, or cloud security certifications.

• Curiosity, sound judgment, and the ability to critically assess and responsibly utilize AI-enabled tools in line with company policies, ethical standards, and regulatory requirements.

• Background screening, including criminal history, is mandatory.

🏝️ Benefits

• Hybrid work model available for eligible onsite employees.

• Opportunities for work-from-home days for focused individual tasks.

• Reasonable accommodations provided for candidates with disabilities, long-term conditions, mental health issues, or sincerely held religious beliefs.