Cloud Security Operations Engineer

Gainsight

9d•Remote

About The Position

Gainsight is seeking a full-time Cloud Security Operations Engineer to join its Security team. This remote role is based in Mexico and reports to the Senior Manager, AI Response & Threat. The engineer will strengthen cloud detection and response across multi-cloud environments by building detection coverage, leading incident investigations, and developing tools and processes that improve team effectiveness. The role involves collaboration with engineering teams and technical and non-technical stakeholders in a complex enterprise environment. Occasional travel of up to 10–20% may be required for team meetings, training, or company events. The responsibilities and scope may evolve with the needs of the team and business.

Requirements

At least 4 years of experience in security engineering, SOC operations (T2/T3), or incident response in a complex enterprise environment, including at least 3 years defending production cloud workloads.
Bachelor’s degree or equivalent experience and/or 5 years of related experience.
Strong knowledge of cloud security architecture and telemetry in at least one major provider (AWS, Azure, or GCP), including log sources needed for detection and investigation.
Deep understanding of cloud IAM and identity-based attack paths, including role assumption abuse, federation weaknesses, and long-lived credential compromise.
Hands-on experience investigating real cloud incidents using native cloud logs and forensic acquisition methods.
Experience with cloud-native threat detection services and ingesting and normalizing cloud logs in a SIEM.
Working knowledge of cloud infrastructure, including compute, storage, networking, and serverless, sufficient to assess risk and advise on remediation.
Advanced proficiency with an enterprise SIEM, including detection authoring, correlation rules, pipeline administration, and tuning to reduce false positives at scale.
Working command of MITRE ATT&CK to map detections to technique coverage, identify telemetry gaps, and design hunts for specific adversary behaviors.
Digital forensics experience across host, network, and memory artifacts, including memory acquisition, disk imaging, and multi-source timeline correlation.
Scripting skills in Python, PowerShell, or Bash, with production automation, log enrichment, or tooling integrations to demonstrate.

Nice To Haves

CSPM/CNAPP or cloud workload protection experience, such as Wiz, Prisma Cloud, Defender for Cloud, or Orca.
Experience in multi-cloud environments.
Container and Kubernetes security experience (EKS, AKS, GKE), including runtime threat detection and image scanning.
Infrastructure as code experience for cloud guardrails and security configuration, such as Terraform or CloudFormation.
SOAR experience (XSOAR, Splunk SOAR, or Torq), including playbook development, API integrations, and case management.
Detection-as-code workflows with CI/CD integration and automated rule validation.
Relevant professional certifications such as GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer.

Responsibilities

Triage and investigate alerts end-to-end across cloud-native tools, determine severity and scope, and document findings.
Detect and respond to cloud threats, including identity compromise, privilege escalation, access key and token abuse, misconfiguration exploitation, and data exfiltration from cloud storage.
Build detections using cloud audit logs, network flow logs, and container and workload telemetry.
Conduct proactive threat hunts using ATT&CK-aligned methods, including the Cloud and Containers matrices.
Automate cloud containment actions such as credential revocation, instance isolation, and policy quarantine.
Lead incident response from scoping and containment through post-incident review; conduct forensics across cloud, host, network, and memory, and communicate findings to technical and non-technical stakeholders.
Build, tune, and maintain SIEM correlation rules and Sigma-based detection-as-code pipelines to reduce noise and improve signal quality.
Own the health and reliability of SecOps tooling, including SIEM, EDR, SOAR, and log ingestion pipelines; ensure coverage and integration uptime and escalate vendor issues.
Participate in the on-call rotation, maintain operational runbooks, and contribute to red and purple team exercises.