Security Engineer

Implementing a centralized security telemetry pipeline that aggregates logs and signals from networks, compute clusters, storage, endpoints devices, build systems, and cloud services into a unified SIEM for improved detection coverage.

Designing and developing Security Orchestration, Automation, and Response (SOAR) workflows to automate repetitive tasks like alert triage, data gathering, and initial containment, which improves SOC efficiency.

Help build a secure and flexible end user access framework that uses SDWAN, SASE, CASB, conditional access, EDR and XDR, and MDM/MAM to support productive, friction-free and secure work from any location using different devices.

Network Security Monitoring: Configuring and monitoring network intrusion detection/prevention systems (IDS/IPS) and firewalls to detect anomalies in network traffic, especially on the SDWAN and client VPN links

Creating and refining detailed, documented incident response plans and playbooks tailored to specific scenarios, such as a breach in a lab environment or a compromised silicon testing machine.

Conducting regular vulnerability assessments and penetration testing on internal systems and applications, then coordinating with relevant teams to manage and remediate identified weaknesses.

5-7+ years of experience in security engineering, SOC operations, detection engineering, incident response, or a similar role that blends hands-on technical work with analytical problem solving.

Strong software engineering skills with Python, Go, Bash, (C and Rust a major plus), including the ability to design, implement, and maintain high-quality code, automation frameworks, services, and integrations that improve security, observability, and operational efficiency.

Proficiency with SIEM and SOAR platforms, including experience building detections, dashboards, and automated workflows.

Deep understanding of EDR and XDR platforms, endpoint security hardening, and telemetry collection across macOS, Linux, Windows, and server environments.

Experience implementing or supporting zero trust architectures, including conditional access, SASE, CASB, and identity-driven access control models.

Familiarity with IAM and SSO systems such as Okta, Google Workspace, and FreeIPA and the ability to design secure identity, access, and authentication policies.

Strong networking knowledge, including SDWAN, VPN, IDS and IPS, firewall administration, segmentation strategy, and monitoring of network traffic for anomalies.

Hands-on experience managing or building security telemetry pipelines, log ingestion frameworks, or observability systems that support both structured and unstructured data.

Solid understanding of threat modeling, the MITRE ATT and CK framework, attacker tradecraft, and common detection and response patterns.

Experience performing vulnerability assessments, penetration testing, or secure configuration reviews and collaborating with teams to remediate identified risks.

Exposure to cloud and hybrid environments such as AWS, GCP, or on-prem clusters and the ability to evaluate risks and implement protective controls across these environments.

Etched believes in the Bitter Lesson . We think most of the progress in the AI field has come from using more FLOPs to train and run models, and the best way to get more FLOPs is to build model-specific hardware. Larger and larger training runs encourage companies to consolidate around fewer model architectures, which creates a market for single-model ASICs.

We are a fully in-person team in San Jose (Santana Row), and greatly value engineering skills. We do not have boundaries between engineering and research, and we expect all of our technical staff to contribute to both as needed.