Principal Security Engineer, Operations
Core
Own detection and response for the corporate environment, running SIEM, triaging alerts, and driving incidents from signal through containment.
Role type
Principal Security Engineer (Operations/Incident Response)
Builds
Detection content, response playbooks, automation, and incident response capabilities for the corporate environment
Domain
Cybersecurity, Satellite/Aerospace
Required skills
SIEM administration and tuning, incident command and response, detection-as-code, threat hunting, adversary emulation, forensics, scripting/automation, MITRE ATT&CK
Preferred skills
Cloud detection (AWS/Azure/GCP), malware analysis, reverse engineering, defense/aerospace experience, security community contributions
Technologies
Splunk, Microsoft Sentinel, Elastic, Panther, Chronicle, SOAR, Python, Go, C++, Rust, macOS, Windows, Linux
Responsibilities
Administer and mature the SIEM, write and maintain detection content using detection-as-code, act as incident commander, build response playbooks and automation, perform threat hunting and adversary emulation, conduct host/network/cloud forensics, investigate phishing and insider risk, partner with IT to harden controls, translate findings into vulnerability priorities, participate in on-call rotation, mentor junior members, support compliance audits
Seniority
Principal, hands-on IC with mentorship
