Staff Security Engineer – Detection & Response

Lead end-to-end incident response for security incidents including endpoint, cloud, and infrastructure compromises, phishing, and insider risks.

Investigate and triage alerts from SIEM/UEBA, EDR, cloud, and email security platforms to confirm real intrusions and reduce false positives.

Develop and maintain detection content, incident response playbooks, and automate security operations tasks to improve detection and remediation.

7+ years of experience in security operations, detection and response, or incident response.

Hands-on experience with SIEM/UEBA and endpoint detection and response tools for alert investigation.

Experience leading incident response through containment, eradication, and recovery.

Working knowledge of cloud security (ideally AWS) and attacker tradecraft including frameworks such as MITRE ATT&CK.

Proficient at managing complex incident response with cross-team coordination and clear communication to technical and executive stakeholders.

Experienced in scripting or automation (e.g., Python) to integrate tools and reduce manual tasks.

Strong understanding of attacker techniques across endpoint, identity, network, and cloud, with ability to write and tune detection logic.