Senior Security Operations Engineer

About the role

The organization operates in the IT and Security data space, addressing critical data challenges for major clients across demanding industries. As a remote-first company, it focuses on empowering employees to deliver high-quality results from any location. The company’s data platform supports security and IT operations by enabling advanced data management and analysis at scale.

The Senior Security Operations Engineer will play a key role in enhancing the organization’s security posture through advanced security operations and threat detection. This position leads incident management, triage, and investigations while developing solutions to address current threats and prevent future attacks. The role requires designing, implementing, and optimizing detection logic to identify complex threats and collaborating with Product Security, IT, and Legal teams to strengthen overall security.

Responsibilities

• Monitor security events and alerts using various security tools including MSSP, SIEM, AI, and CSPM
• Develop, implement, and maintain detection rules and alerts within SIEM and other platforms based on threat intelligence and frameworks like MITRE ATT&CK
• Tune and optimize detection logic to reduce false positives and improve effectiveness
• Lead security incident response and investigations, improving detection capabilities as needed
• Build and manage security playbooks following best practices in detection engineering
• Conduct security assessments through vulnerability tests, threat hunts, and purple team exercises
• Perform internal and external security reviews of corporate assets including websites and applications
• Lead tabletop exercises for incident response preparedness
• Integrate organization’s security products within the security tech stack to enhance detection and response
• Collaborate with threat intelligence teams to incorporate new indicators of compromise and tactics into detection strategies

Requirements

• Experience with modern security principles such as security data lakes, detections as code, EDR, zero trust networking, and security tooling
• Strong knowledge of common attack frameworks, especially MITRE ATT&CK, and mapping detections to tactics, techniques, and procedures
• Familiarity with authentication and authorization protocols including SAML, OpenID, OAuth2, and SCIM
• Proficiency in scripting or coding with Python, NodeJS, Ruby, or Bash
• Ability to communicate complex security concepts to both technical and non-technical audiences
• Comfortable working remotely across multiple time zones, occasionally outside standard hours
• Experience with security event monitoring, incident response, and management
• Knowledge of SIEM platforms such as Panther and cloud security tools like Wiz in AWS, Azure, or GCP environments is a plus
• Relevant certifications in cloud security or incident response, such as SANS GIAC, preferred
• Proven experience developing and maintaining detection rules using Sigma, YARA, Splunk SPL, or KQL

Pay

Salary range from $128,000 to $200,000, dependent on geographic location, skills, and experience.

Benefits

• Health, dental, and vision insurance
• Short-term disability
• Life insurance
• Paid holidays and paid time off
• Fertility treatment benefit
• 401(k) retirement plan
• Equity participation
• Discretionary company-wide bonus eligibility