Staff Security Engineer, Security Operations
New
G
GoodLeapSecurity operations
Remote, USFull-TimeStaff
Salary$167,400 - $212,500 a year; Base pay range (CA, WA, NJ, MA, DC, NYC) per year: $184,100 - $212,500; Base pay range (all other US locations) per year: $167,400 - $193,200. In addition to the above salary, this role may be eligible for a bonus and equity.
Apply NowOpens the employer's application page
Job Details
- Required Skills
- AWSPython
Requirements
- Bring in-depth knowledge of Amazon AWS security configuration, logging, and tooling, such as CloudTrail, GuardDuty, and Security Hub.
- Have hands-on detection engineering experience, including SIEM query languages and detection-as-code.
- Have hands-on incident response experience, including log analysis and host and cloud investigation.
- Be familiar with the MITRE ATT&CK framework and OWASP Top 10.
- Know network and web protocols, including TCP/IP, DNS, HTTP, HTTPS, and TLS.
- Have experience with EDR platforms or the ability to ramp quickly; CrowdStrike Falcon is preferred.
- Have experience with email security, including phishing, BEC, DMARC, SPF, and DKIM, or the ability to ramp quickly.
- Have experience building automation in Python or a similar language.
- Have experience building or integrating LLM-based agents and workflows.
- Understand AI-specific risks such as prompt injection, data leakage, and excessive agent permissions.
- Have experience working in a SOC 2, PCI-DSS, or ISO control environment.
- GCIH, GCFA, GCDA, CCSP, CISSP, CrowdStrike, or comparable certifications are a plus.
Responsibilities
- Design, build, test, and tune detections across cloud, identity, endpoint, and email telemetry using detection-as-code practices mapped to MITRE ATT&CK.
- Manage security logging, SIEM, and alerting pipelines.
- Monitor AI tools, agents, MCP integrations, and API keys for data exposure, misuse, and anomalous behavior.
- Lead investigation, containment, eradication, and recovery for security incidents.
- Coordinate significant incident response with legal, compliance, and leadership on regulatory notification obligations.
- Maintain incident response plans, playbooks, and runbooks, and conduct tabletop exercises and post-incident reviews.
- Deploy and manage security operations tools, including cloud security monitoring, WAF, DDoS protection, IDS, CrowdStrike EDR, and email security.
- Build AI agents and automation for alert triage, enrichment, investigation, and response.
- Review vulnerability scan and penetration test results, identify true positives, and propose remediation or mitigating controls.
- Advise on AWS cloud security and secure design, and mentor security and partner engineering teams.
View Full Description & ApplyYou'll be redirected to the employer's site
