Security Operations Engineer

About the role

23andMe Research Institute is looking for an experienced Security Operations Engineer to join our Security Operations team. In this role you will lead security incident response as Incident Commander, triage and investigate alerts, and build the detection and automation architecture to help protect our customer and corporate data. You will bring critical thinking skills, hands-on experience, and the ability to work with and influence cross-functional teams. Since 2006, 23andMe Research Institute’s mission has been to help people access, understand, and benefit from the human genome. We are a group of passionate individuals pushing the boundaries of what’s possible to help turn genetic insight into better health and personal understanding.

Responsibilities

• Design, build, and tune threat detections; measure and improve fidelity over time.
• Operate and extend detections-as-code pipeline using Terraform.
• Triage, investigate, and prioritize security alerts across endpoint, identity, cloud, and application telemetry.
• Conduct proactive threat hunting informed by current attacker tradecraft.
• Identify automation opportunities and build integrations to reduce manual response effort.
• Serve as Incident Commander on a shared rotation, coordinating response across Engineering, IT, Legal, and Privacy.
• Maintain and improve incident response runbooks and playbooks.
• Track open incidents through closure, confirm corrective and preventive actions, and report incident metrics to security leadership.
• Partner with Engineering, IT, Research, and Compliance to build security automation and measure impact on detection and response time.
• Participate in an on-call rotation.

Requirements

• 4+ years in security operations, detection engineering, or incident response.
• Detection-as-code experience or background in building response automation.
• Demonstrated hands‑on experience with threat detection, threat hunting, and incident investigation, including working directly with logs and telemetry to establish root cause.
• Proficiency in at least one scripting language (Python preferred) and familiarity with common operating systems.
• Experience acting as, or deputy to, the lead responder on at least one significant security incident.
• Proficiency with EDR and SIEM platforms.
• Familiarity with a modern enterprise stack such as Okta, AWS, CrowdStrike or SentinelOne, Datadog, Sumo Logic, or Splunk.
• Clear verbal and written communication, including ability to stay composed under incident pressure and brief technical and non‑technical audiences.
• Bachelor's degree in Computer Science, Information Systems, or a related field, or an equivalent combination of education and experience.

Qualifications

• Experience applying AI‑assisted tooling to triage, correlation,