Senior Security Engineer, Operations

Responsibilities

• Own day-to-day detection and response across the corporate environment, from alert triage and investigation through containment and remediation
• Administer and mature the SIEM, including log source onboarding, parsing and normalization, telemetry enrichment, rule tuning, and platform health, retention, and cost
• Write, test, and maintain detection content mapped to MITRE ATT&CK using detection-as-code practices, including version control, peer review, and automated testing
• Act as incident commander for corporate security incidents, coordinating stakeholders and delivering timelines, root cause analysis, and post-incident follow-through
• Build response playbooks and automation across SOAR, scripting, and vendor APIs to reduce time to detect, triage, and contain
• Threat hunt proactively across endpoint, identity, SaaS, and cloud telemetry using threat intelligence and hypotheses about adversary behavior
• Run adversary emulation and purple team exercises to validate detection coverage, then close the gaps you find
• Perform host, network, and cloud forensics across macOS, Windows, and Linux to reconstruct attacker activity and scope impact
• Investigate phishing, business email compromise, credential abuse, and insider risk in partnership with IT, HR, and Legal
• Partner with IT and infrastructure teams to harden identity, endpoint, and network controls, including conditional access, EDR policy, MDM baselines, segmentation, and secure remote access, informed by what investigations reveal
• Translate detection and incident findings into vulnerability management priorities and security architecture improvements
• Participate in an on-call rotation for security escalations, including occasional after-hours and weekend response
• Maintain runbooks, detection documentation, and standard operating procedures, and mentor junior team members on investigation and response tradecraft
• Support compliance and audit efforts by producing monitoring, detection, and incident response evidence as needed

Qualifications