Security Operations Engineer
Core
Own daily operation and continuous improvement of Alpaca's SIEM and SOAR capabilities, including log onboarding, detection tuning, alert management, and response automation.
Role type
Security Operations Engineer (SIEM/SOAR)
Builds
SIEM detections, SOAR playbooks, operational dashboards, and incident response runbooks
Domain
Cybersecurity, Security Operations, Cloud Security
Required skills
SIEM operations, SOAR playbook development, log parsing and normalization, alert investigation, incident response, threat hunting, Linux administration, Python scripting, Bash scripting, cloud log onboarding (AWS/GCP/Azure), SaaS telemetry analysis
Preferred skills
Financial services security, SOC 2/ISO 27001 compliance, detection-as-code, GitOps, Kubernetes security tooling, MSSP experience, security certifications (GCIA/GCIH/GCED)
Technologies
SIEM, SOAR, Python, Bash, Linux, AWS, GCP, Azure, Kubernetes
Responsibilities
Onboard and parse security logs from cloud, identity, endpoint, and SaaS sources; build and tune detection rules based on threat intelligence; maintain operational dashboards for alert volume and ingest health; develop and improve incident response runbooks; triage and investigate security alerts; participate in on-call rotation; run hypothesis-driven threat hunts
Seniority
Mid-level, hands-on IC
