Security Operations Engineer II

Axon•Scottsdale, AZ

3d•Onsite

About The Position

Axon is hiring an engineer-first member of its Security Operations Center, which monitors, investigates, and responds to security events across Axon's corporate, cloud, and regulated SaaS environments. The role combines incident response and alert triage with engineering work to automate repetitive SOC tasks, build tool integrations and threat detections, and improve response capabilities as the company grows. The position is onsite at Axon's Scottsdale, Arizona or Seattle, Washington office and reports to the Manager, Information Security Engineering. There are no direct reports. The engineer responds to alerts and tickets, participates in a shared queue and on-call rotation, and leads incidents from initial findings through root cause analysis, remediation, and closure. Incident learnings are used to improve detections, playbooks, runbooks, and reusable team tooling. The role also supports identity and access operations, audit and compliance evidence collection, security tooling integrations, and cloud infrastructure supporting security tools. The position designs, builds, and operates production security automation using version control, code review, testing, and CI/CD. It owns the detection lifecycle, deploys infrastructure as code with least-privilege design, evaluates new security tooling, and measures automation's impact on team workload and response time. Candidates must be able to pass a standard FBI background check for access to Criminal Justice Information Systems.

Requirements

At least 2 years of experience in security engineering, SOC or detection engineering, or software or infrastructure roles with a security focus.
Strong Python, shell scripting, and Git skills, with experience shipping and maintaining production code.
Hands-on incident response and alert triage experience and comfort participating in an on-call rotation.
Experience with a SIEM, log analytics platform, or SOAR or workflow automation platform.
Working knowledge of cloud platforms, identity providers, endpoint detection and response (EDR), REST APIs, and authentication.
Experience with infrastructure-as-code tools.
Experience with Git-based collaborative development, including branching, pull requests, and code review.
Experience building and maintaining production CI/CD pipelines.
Understanding of the software development lifecycle and application design, with a habit of writing maintainable, tested code.
Familiarity with secure development practices such as dependency scanning, secrets scanning, and managing secrets in pipelines.
Clear written communication for runbooks, incident timelines, and audit evidence.
Ability to pass a standard FBI background check for access to Criminal Justice Information Systems.

Responsibilities

Investigate and respond to security alerts, security tickets, and user-reported phishing in the team's shared queue rotation.
Participate in the on-call rotation and investigate, contain, and coordinate escalated security events, including exposed credentials, data spillage, suspicious account activity, and cloud account compromise.
Own incidents through closure, including documenting timelines, identifying root causes, tracking remediation, and updating detections or playbooks.
Identify repetitive manual work and replace it with automation, including phishing triage and enrichment, offboarding verification, vulnerability remediation tracking, and bulk ticket handling.
Write, tune, and document detections against security logs, retire noisy alerts, and create a runbook for each alert shipped.
Support identity and access operations, including offboarding, access requests, and access reviews, and automate reliability checks.
Produce audit and compliance evidence and automate its collection where possible.
Design, build, and operate security automation using version control, code review, testing, and CI/CD, including playbooks, chat-based workflows, and services that connect security tools.
Integrate security, identity, IT service management, and cloud platforms through APIs, handling authentication and secrets securely.
Own the detection lifecycle by onboarding log sources, writing and tuning detections, identifying coverage gaps, and managing detections as code.
Deploy and maintain cloud infrastructure behind security tooling using infrastructure as code and least-privilege design.
Build detections and automation that meet strict data-handling and compliance requirements.
Turn incident lessons into reusable playbooks, templates, and tooling that make response consistent across the team.
Evaluate security tooling, including automation platforms and AI-assisted triage, for fit, security, and licensing, and take selected tools into production.
Measure team workload and time saved through automation, and report metrics to guide future investment.
Partner with senior team members on platform design decisions and assist more junior team members with scripting and automation.