Staff Engineer, Security Operations

Role overview Set the strategy and technical direction for security detection and response while remaining hands-on in building detections, automation, and investigation tools. The role also leads complex incidents and establishes repeatable standards, telemetry coverage, and response practices that help a security team identify and contain threats consistently across cloud, SaaS, and corporate systems.

Responsibilities - Turn detection and response priorities into multi-quarter initiatives, report progress and risks in business terms, and coordinate telemetry readiness with engineering, infrastructure, and IT teams. - Define detection architecture and coverage plans for log sources, enrichment, correlation, alert routing, signal quality, and operating cost. - Build and maintain detections, hunts, and response automations using Python, Git, CI/CD, and a modern SIEM; test against historical data and attack simulations and review coverage, latency, and false positives. - Own incident-response plans, severity levels, escalation, communications, on-call practices, playbooks, and forensic readiness. - Lead high-severity investigations and exercises, track response measures such as time to acknowledge and resolve, and turn incident findings into improvements. - Mentor engineers and establish guarded AI-assisted workflows for triage, investigation, and response, including detection of misuse of internal AI features.

Requirements - Eight or more years in detection and response, detection engineering, security engineering, or incident response. - Evidence of leading detection and response strategy or multi-quarter security initiatives with measurable results. - Hands-on experience designing detection architecture and deploying detections on a modern SIEM; experience with Panther is valued. - Strong Python, Git, CI/CD, and detection-as-code skills. - Experience leading serious incidents in cloud and SaaS environments and improving response processes. - Cloud and SaaS expertise, ideally including GCP, plus sound judgment and the ability to influence technical and nontechnical leaders.

Nice to have - Staff, Lead, or Principal-level experience in a high-growth cloud or SaaS environment. - Production use of AI-assisted security workflows, public security contributions, or certifications such as GCIA, GCIH, or GCED.

Benefits and work setup The source lists equity, potential bonus, a 401(k), paid holidays, flexible PTO, parental leave, wellbeing support, travel coverage, insurance, and FSA/HSA options. Listed annual cash compensation ranges from $225,400 to $388,900 depending on location tier; the source also gives a separate transparency range of $225,400–$281,800, so compensation details may vary by location and level.