Security Operations Engineer
Core
Own escalated security investigations, lead moderate-scope incidents, and improve detections/playbooks for an AI-assisted SOC.
Role type
Senior Security Operations Engineer (Incident Response & Detection Engineering)
Builds
Production-quality detection logic, automation workflows, and incident response playbooks
Domain
Cybersecurity, Cloud Security, AI Security
Deliverable
production ML models
Required skills
Incident response leadership, Python automation, SIEM detection engineering, AWS security services, Threat hunting, Investigation ownership
Preferred skills
LLM/agent frameworks, Sigma/SQL/KQL/SPL/YARA, Data security (DSPM/DLP), Infrastructure as Code (Terraform/CDK)
Technologies
Python, AWS, SIEM, Terraform, CDK, LLM frameworks, Sigma, SQL, KQL, SPL, YARA
Responsibilities
Own escalated investigations from triage to closure; Lead moderate-scope incidents and write after-action reports; Build and tune detections across cloud, identity, SaaS, and endpoint telemetry; Improve agent workflows and playbooks; Own internal platform deployment (Customer Zero) and provide product feedback; Mentor newer Security Operations Engineers
Seniority
Mid-Senior, hands-on IC
