Senior Security Operations Engineer
New
F
FleetioSecurity operations
Remote - USA, CAN, MEXFull-TimeSenior
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Experience
- 5+ years of experience in security operations, detection and response, or security engineering, ideally at a SaaS company
- Required Skills
- PythonRESTful APIs
Requirements
- Have 5+ years of experience in security operations, detection and response, or security engineering; SaaS company experience is preferred.
- Have experience with detection engineering and threat hunting in a SIEM, such as CrowdStrike Next-Gen SIEM.
- Build SOAR playbooks that connect identity, endpoint, email, and SaaS tools into response workflows.
- Use Python or PowerShell and REST APIs for security automation.
- Handle incident response from triage through forensics, root cause, and follow-up across cloud, identity, and SaaS environments.
- Have experience working with an MDR or managed SOC provider.
- Understand identity security, including authentication policy, privileged access, and access reviews with Okta or a similar provider.
- Have experience in a SOC 2 or ISO 27001 control environment.
- Have endpoint security experience with CrowdStrike or similar, including macOS, device trust, and endpoint query tooling.
- Have experience with email security, SaaS security posture management, and DLP program design and operation.
- Have experience securing developer tooling and the software supply chain, including IDE extensions, package registries, and AI coding tools.
- Communicate effectively in writing and verbally, including explaining risk to non-technical leaders.
Responsibilities
- Own detection engineering and threat hunting in CrowdStrike Next-Gen SIEM, including log-source onboarding and tuning detections.
- Build security automation that connects identity, endpoint, email, and SaaS tools, and use AI agents to speed triage and investigation.
- Lead corporate incident response, including scoping exposure, confirming or ruling out compromise, conducting forensics, and communicating guidance.
- Maintain incident-response runbooks with Product Security and serve in the escalation rotation, backing up the Incident Commander when needed.
- Own CrowdStrike Falcon configuration and detections, manage Falcon Complete escalations, and maintain device trust checks and software and extension inventories.
- Own Okta authentication policies, MFA, session policies, privileged access management, user access reviews, and audit evidence automation.
- Manage Mimecast, secure network access, Google Workspace, key SaaS security settings, and SaaS security posture findings.
- Define sensitive-data classifications and operate DLP policies across email, Google Workspace, endpoints, and key SaaS apps; investigate data exposure.
- Secure AI usage and agents, and run corporate-asset vulnerability management with prioritization, remediation deadlines, and security posture reporting.
View Full Description & ApplyYou'll be redirected to the employer's site
