Staff Security Engineer

Duties and Responsibilities

• Develop and maintain high-fidelity threat detection content, including rules, analytics, and behavioral detections across infrastructure, endpoint, cloud, SaaS and identity platforms.
• Own and enhance detection engineering workflows, including testing, tuning, false-positive reduction, and coverage analysis.
• Partner closely with external MDR provider to develop and refine detection rules, improve investigation quality, and establish effective escalation and response workflows.
• Support and participate in incident response, including investigation, containment, eradication, and post-incident reviews.
• Build dashboards, metrics, and reports to measure detection coverage, SOC effectiveness, and security posture.
• Monitor and help secure AWS and cloud-native environments, including CloudTrail, VPC Flow Logs, workload logs, and SaaS integrations.
• Evaluate and implement AI-assisted security capabilities for defense and detection, while also defining how AI systems, agents, and usage are logged, monitored, and assessed for risk.
• Develop documentation, runbooks, and operational playbooks for SOC and security engineering workflows.
• Mentor junior engineers and provide technical leadership within the SOC and security engineering functions.
• Stay current on emerging threats, detection techniques, attacker tradecraft, and security data engineering best practices.

Qualifications

• 8+ years of experience in security engineering, security operations, detection engineering, or incident response.
• Strong hands-on experience developing, testing, and tuning SIEM and EDR detections across multiple environments.
• Strong background in threat detection and incident response within a SOC environment.
• Experience owning open source threat intelligence platforms such as MISP, Yeti, and OpenCTI.
• Demonstrated ability to improve alert quality, reduce false positives, and incorporate business context into detection and response decisions.
• Experience working with external MDR providers, managed SOCs, or SIEM service partners to improve detection content, investigations, escalations, and response outcomes.
• Strong incident response experience, including leading technical investigations and coordinating containment, eradication, and recovery activities.
• Hands-on experience with EDR platforms.
• Experience working with identity and access logs.
• Experience investigating threats in AWS environments and working with cloud security telemetry.
• Understanding of AI and machine-learning use cases in security, including detection, automation, and governance considerations.
• Strong written and verbal communication skills including ability to write threat intelligence assessments and reports.
• Ability to work independently and collaboratively in a fast-paced environment.

Preferred Qualifications

• Experience with detection engineering frameworks (e.g., Diamond Model, MITRE ATT&CK).
• Experience in healthcare, biotech, or other regulated environments.
• Security certifications such as CISSP, GIAC, GCED, GCIA, or cloud security certifications.