Senior Security Engineer

Role overview Build and operate security systems that protect endpoints, cloud infrastructure, identity, and production services. The work spans large-scale security telemetry and detection, incident response, security platform development, and helping engineering teams make secure design choices.

Responsibilities - Develop and operate a security data platform for high-volume telemetry, including ingestion, normalization, retention, queries, and tested detection logic. - Manage endpoint protections such as EDR, binary authorization, and hardening baselines across the device fleet. - Lead threat hunting, insider-risk investigations, and incident response from triage and containment through forensics, root-cause analysis, and preventive controls. - Build and run security services for identity and access, application proxying, blocking, asset inventory, developer workflows, and compliance automation. - Operate agent-based automation for security triage and investigation, using deterministic checks where model output needs verification. - Review cloud, Kubernetes, bare-metal, and CI infrastructure designs; run adversary simulations and turn findings into fixes and detections. - Write actionable runbooks and incident reviews that support teams responding under pressure.

Requirements - At least five years in security engineering, detection and response, or infrastructure/SRE with a security focus, including hands-on endpoint and cloud incident response. - Experience operating EDR and tuning detections, with practical knowledge of macOS and Linux attack techniques and internals. - Experience with telemetry pipelines and a SIEM or security data lake at terabyte scale; strong SQL for querying and detection work. - Production engineering experience with Linux, containers, Kubernetes, a major cloud platform, infrastructure as code, monitoring, and alerting. - Proficiency in Python or Go; willingness to work with Rust; familiarity with SSO, phishing-resistant MFA, device trust, and token or session theft. - Strong written communication, including incident coordination and post-incident reporting; interest in web3 is required. - A relevant technical degree or equivalent practical experience.

Nice to have - Experience with zero-trust access, identity-aware proxies, policy engines, or fleet-wide binary authorization. - Digital forensics, malware analysis, or familiarity with threats targeting crypto organizations and their supply chains. - Security tooling that uses LLM agents, compliance automation, or work in ISO 27001 or SOC 2 environments. - Security publications, conference talks, or open-source tooling.