Staff Security Engineer, Security Operations
Ai Security
Analytics
Cloud Platforms
Cyber Security
Cybersecurity Operations
Cybersecurity Tools
Data Platform
Data Processing
Data Security
Digital Marketing
Endpoint Security
Facilities Management
Identity and Access Management
Incident Management
Incident Response
Information Security
Information Technology (IT)
InfoSec
Log Management
Management
Risk Management
Security
Security Automation
Security Compliance
Security Detection Engineering
Security Engineering
Security Information And Event Management
Security Logging
Security Monitoring
Security Operations
Security Standards
Security Testing
Software Development
Splunk
Splunk Siem
Job Description
The Staff Security Engineer, Security Operations role focuses on protecting GoodLeap’s cloud and application environments, endpoints, and corporate systems. This position combines detection engineering, security operations, and incident response, while also designing AI agent and automation capabilities to improve time-to-detect and time-to-respond.
Responsibilities
- Design, build, test, and tune detections across cloud, identity, endpoint, and email telemetry using detection-as-code practices aligned to MITRE ATT&CK.
- Manage security logging, including SIEM and alerting pipelines.
- Establish monitoring for AI activity, including AI tools, agents, MCP integrations, and API keys to detect data exposure, misuse, and anomalous behavior.
- Reduce time-to-detect using threat intelligence and sensor enrichment.
- Lead incident investigation and response activities, including containment, eradication, and recovery.
- Act as incident lead for significant events and coordinate with legal, compliance, and leadership regarding regulatory notification obligations.
- Maintain incident response plans, playbooks, and runbooks.
- Conduct tabletop exercises and post-incident reviews to drive control improvements.
- Deploy and manage the security operations toolset, including cloud security monitoring, WAF, DDoS protection, IDS, EDR (CrowdStrike), and email security.
- Build AI agents and automation for alert triage, enrichment, investigation, and response.
- Review vulnerability scan results, penetration testing outcomes, and other findings to identify true positives and propose remediation or mitigating controls.
- Serve as a subject matter expert (SME) in AWS cloud security and consult on secure designs for cloud-based systems.
- Provide mentorship and guidance to the security team and partner engineering teams on detection, response, and security operations practices.
- Share detailed knowledge of company and industry methodologies, policies, standards, and controls.
- Help build the security team and lead efforts to mature GoodLeap’s security operations capability.
- Develop security requirements, conduct security risk assessments, evaluate security services and technologies, maintain incident response plans and runbooks, and mentor security and partner engineering teams.
- Own endpoint detection and response using CrowdStrike and email security as these capabilities are brought into the security function.
Requirements
- In-depth knowledge of Amazon AWS, including security configuration, logging, and tooling such as CloudTrail, GuardDuty, and Security Hub.
- Hands-on detection engineering experience, including SIEM query languages and detection-as-code.
- Hands-on incident response experience, including log analysis and host and cloud investigation.
- Familiarity with MITRE ATT&CK and OWASP Top 10.
- Knowledge of network and web protocols including TCP/IP, DNS, HTTP, HTTPS, and TLS.
- Experience with, or ability to quickly ramp on, EDR platforms (preferred: CrowdStrike Falcon).
- Experience with, or ability to quickly ramp on, email security including phishing, BEC, and DMARC/SPF/DKIM.
- Experience building automation in Python or a similar language.
- Experience building or integrating LLM-based agents and workflows.
- Understanding of AI-specific risks such as prompt injection, data leakage, and excessive agent permissions.
- Experience working in SOC 2, PCI-DSS, or ISO control environments.
- Proven ability to combine business acumen, technical acumen, and process expertise to assess requirements and alignment.
- Strong communication across verbal, written, ticketing, and messaging channels.
- Ability to prioritize and deliver on multiple tasks independently with a strong bias toward action in a fast-paced environment.
- Preferred: GCIH, GCFA, GCDA, CCSP, CISSP, CrowdStrike, or comparable certifications.
Technologies
- Amazon AWS, CloudTrail, GuardDuty, Security Hub
- MITRE ATT&CK, OWASP Top 10
- SIEM, CrowdStrike Falcon, CrowdStrike, EDR, WAF, DDoS protection, IDS
- TCP/IP, DNS, HTTP, HTTPS, TLS
- Python, LLM-based agents, MCP integrations, API keys
- DMARC, SPF, DKIM
- SOC 2, PCI-DSS, ISO
Compensation
Remote role with the following base pay ranges by location:
- CA, WA, NJ, MA, DC, NYC: USD $184,100 - $212,500 per year (base pay range)
- All other US locations: USD $167,400 - $193,200 per year (base pay range)
In addition to the above salary, this role may be eligible for a bonus and equity.
Similar Jobs
