Staff Security Engineer

Role overview

Strengthen an organization’s ability to detect, investigate, and respond to security threats. This hands-on technical leadership role spans detection engineering, threat intelligence, cloud and identity monitoring, automation, and incident response. You will improve security operations while helping establish sound monitoring and risk practices for AI systems and agents used across the enterprise.

Responsibilities

- Build and maintain threat detections across infrastructure, endpoints, cloud services, SaaS, and identity platforms; test and tune them to improve coverage and reduce false alerts. - Work with a managed detection and response provider to improve detection rules, investigation quality, escalations, and response workflows. - Participate in incident response, including investigation, containment, eradication, recovery, and post-incident review. - Monitor cloud environments and relevant telemetry, including AWS activity, network flow, workload, and SaaS integration logs. - Create dashboards and reports that track detection coverage, security operations performance, and overall posture. - Document operational playbooks, assess AI-assisted security capabilities, and mentor engineers across security operations and engineering.

Requirements

- At least eight years in security engineering, security operations, detection engineering, or incident response. - Strong practical experience creating, testing, and tuning SIEM and endpoint detection rules in a security operations environment. - Experience leading technical investigations and coordinating incident containment, eradication, and recovery. - Experience with endpoint detection tools, identity and access logs, AWS investigations, and cloud security telemetry. - Ability to improve alert quality, account for business context, and work effectively with external managed security or SIEM providers. - Strong written and verbal communication skills, including the ability to write threat assessments and reports; understanding of AI and machine-learning security, automation, and governance considerations.

Nice to have

- Experience operating open-source threat intelligence platforms such as MISP, Yeti, or OpenCTI.

Benefits and work setup

- The listing identifies the position as open to remote candidates in the United States. Employees who live within 50 miles of a facility are expected to work onsite Monday, Tuesday, and Thursday. - The listing provides a base salary range of $133,960–$184,195 for most U.S. locations, with a separate range of $141,840–$195,030 for Colorado; the final offer depends on location and qualifications.