Cloud Security Operations Engineer

Role overview

Strengthen cloud detection and incident response across production environments. You’ll investigate threats, improve security coverage, and build the detections, automation, and operational processes that help a security team respond effectively. The role involves close work with engineering and both technical and non-technical stakeholders.

Responsibilities - Triage cloud security alerts, establish severity and scope, investigate findings, and document outcomes. - Detect and respond to threats such as compromised identities, privilege escalation, credential misuse, cloud misconfiguration, and storage data theft. - Build detections from cloud audit, identity, network, container, and workload telemetry; run proactive hunts informed by ATT&CK techniques. - Lead incident response from scoping and containment through forensic investigation and post-incident review, communicating findings to varied audiences. - Create and tune SIEM correlation rules and detection-as-code pipelines, and automate containment actions such as credential revocation or instance isolation. - Maintain SIEM, EDR, SOAR, and log-ingestion reliability; support runbooks, on-call coverage, and red or purple team exercises.

Requirements - 4+ years in security engineering, advanced SOC operations, or incident response, including 3+ years defending production cloud workloads. - Strong knowledge of security architecture and telemetry in at least one major cloud provider: AWS, Azure, or GCP. - Deep understanding of cloud identity and access risks, including role assumption, federation weaknesses, and long-lived credentials. - Experience investigating real cloud incidents using native logs and forensic acquisition methods. - Experience with cloud threat detection services and ingesting and normalizing cloud logs in an enterprise SIEM. - Working knowledge of cloud compute, storage, networking, and serverless, plus proficiency in SIEM detection authoring, correlation, administration, and tuning.

Nice to have - Cloud security posture or workload protection, multi-cloud, Kubernetes/container security, infrastructure as code, or SOAR playbook experience. - Detection-as-code with CI/CD validation, relevant security certifications, and scripting for automation or log enrichment.

Benefits and work setup - Full-time remote role based in Mexico, with participation in an on-call rotation. - Occasional travel may be required, estimated at 10–20% for team meetings, training, or events.