Security Operations Engineer

Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments, establishing what happened from evidence and communicating uncertainty clearly.

Build and tune detections, onboard useful telemetry, and maintain reliable log pipelines, testing rules against real and benign activity to close coverage gaps and reduce noisy alerts.

Participate in the security on-call rotation and incident response, including scoping, containment, recovery, and post-incident improvements, while preserving evidence and coordinating with system owners.

Build AI-assisted security workflows that automate evidence collection, alert enrichment, investigation timelines, and response preparation, connecting agents to approved tools and data sources for traceable, bounded tasks.

Evaluate AI-assisted workflows against known and adversarial cases, requiring evidence for conclusions, testing for false positives and missed threats, and keeping human approval for disruptive containment actions.

Partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls, and attack-surface monitoring, prioritizing findings by exposure and impact and verifying remediation.

Work with platform and product-security partners on operational controls for agent identities, credentials, tool access, and audit logging, investigating misuse and building detections for suspicious agent behavior.

Share reusable code, investigation skills, runbooks, and evaluation cases, pairing with teammates and reviewing automation to help them apply these approaches independently.

Track detection coverage, alert quality, investigation effort, response time, and remediation progress, using these measures to prioritize improvements.

Hands-on security operations experience spanning detection engineering, threat hunting, and incident response.

Strong scripting and software-building ability, especially in Python, with experience using APIs, version control, tests, and operating automation in production.

Experience with a SIEM such as Panther, Splunk, or an equivalent platform, including detection logic and log analysis.

Working knowledge of cloud security, identity, endpoint telemetry, networking, and Linux systems, with the ability to investigate across system boundaries.

Evidence of building and using AI-assisted tools in security or adjacent engineering work, including how you validate outputs, handle failures, and protect sensitive information.

Sound incident judgment — the ability to separate a hypothesis from a finding, preserve evidence, and decide when to escalate or contain.

A track record of making teammates more effective through tools, mentoring, code review, or documentation, without relying on management authority.

Clear written communication and willingness to own both urgent investigations and the follow-through that prevents repeat incidents.