Aurora’s Detection & Response team is building stronger cloud and enterprise security capabilities through better telemetry, detection engineering, and incident readiness. As a Staff Security Engineer on the Cloud Detection & Response team, you will help mature detection infrastructure across multi-quarter, cross-functional initiatives, partnering with engineering and SOC stakeholders to expand coverage and improve outcomes for real-world threats.
Location: Dallas, TX (onsite)
Compensation: USD 171,000 - 303,000 per year
Experience: 10+ years
What you’ll do
- Lead cross-functional efforts to mature detection infrastructure, including log ingestion and normalization, detection-as-code pipelines with testing, versioning, and CI/CD, and scalable telemetry collection that considers cost.
- Increase detection coverage across cloud and enterprise environments, prioritizing high-impact coverage improvements.
- Design, build, and tune detections for cloud control plane and workload activity, identity-based attacks, endpoint, and SaaS threats, including abuse of CI/CD and service-to-service communication paths.
- Partner with Cloud Infrastructure, IT, and Platform Engineering to embed logging and detection requirements into system design, and represent Detection & Response in working groups and design reviews.
- Integrate threat intelligence and adversary emulation into coverage priorities, and run proactive threat hunting across cloud, identity, endpoint, and SaaS data.
- Handle cloud and enterprise security incidents and participate in an on-call rotation, using lessons learned to drive improvements to detections and infrastructure.
- Collaborate with and mentor SOC engineers on cloud and enterprise detection practices, and contribute to quarterly planning for detection infrastructure and coverage initiatives.
What you bring
- 10+ years of security experience, including leading cross-functional security projects or programs from scoping through delivery.
- Strong technical foundation in threat detection and incident response.
- Expertise in cloud security across one or more major providers, including cloud-native telemetry and detection sources.
- Experience building or maturing detection infrastructure such as SIEM or security data lake pipelines, log onboarding/normalization, and detection-as-code workflows.
- Expertise with EDR and SaaS security monitoring, or comparable depth across host and application telemetry.
- Ability to author and maintain detections (anomalous, network, host, identity, and cloud activity) and measure detection coverage against adversary behavior.
- Experience in incident management and driving cross-departmental collaboration for containment and remediation.
- Expertise with MITRE ATT&CK and modern adversarial techniques, and understanding of NIST CSF.
- Ability to write quality, testable Python.
Helpful experience
- Experience designing and implementing Zero Trust Architecture.
- Experience scaling SOC and Detection Engineering with AI/LLM.
- Experience building and architecting data lakes.
- Experience with compliance frameworks such as SOC 2 and ISO 27001.
Technologies you’ll work with
- Python
- MITRE ATT&CK
- NIST CSF
- SIEM
- detection-as-code
- CI/CD
- EDR
Additional location and pay details
- For roles based in Mountain View, the salary range is $189,000 - $303,000 per year.
- For roles based in Pittsburgh, PA, the salary range is $171,000 - $273,000 per year.
Aurora’s pay ranges are determined by role, level, and location. Within the range, starting base pay is based on job-related skills, experience, qualifications, relevant education or training, and market conditions. Ranges may be modified in the future. The successful candidate may also be eligible for an annual bonus, equity compensation, and benefits.
Working at Aurora
Aurorans are expected to work from the office at least 3 days per week, with some roles requiring more frequent in-office presence, up to 5 days per week, based on operational needs.
