Security Operations Engineer II

Axon•Washington, DC

3d•$96,000 - $153,600•Onsite

About The Position

As an engineer-first member of Axon's Security Operations Center, the Security Operations Engineer II monitors, investigates, and responds to security events across corporate, cloud, and regulated SaaS environments serving public safety agencies and enterprises. The role responds to alerts, triages incidents, participates in an on-call rotation, and uses operational experience to automate repetitive work. It builds automation playbooks, tool integrations, and threat detections, and leads incidents from initial findings through root cause analysis and remediation. The role is onsite at Axon's Scottsdale, Arizona or Seattle, Washington office and reports to the Manager, Information Security Engineering. It has no direct reports. The engineer designs, builds, and operates security automation and integrations; owns the detection lifecycle; maintains cloud infrastructure for security tooling; and develops capabilities that help the SOC scale. The role also supports identity and access operations, audit and compliance evidence collection, evaluation of new tooling, and measurement of workload and automation impact. It partners with senior team members on platform design and assists more junior team members with scripting and automation.

Requirements

At least 2 years of experience in security engineering, SOC or detection engineering, or software or infrastructure roles with a security focus.
Strong Python, shell scripting, and Git skills, with experience shipping and maintaining production code.
Hands-on incident response and alert triage experience, and comfort participating in an on-call rotation.
Experience with a SIEM, log analytics platform, or SOAR or workflow automation platform.
Working knowledge of cloud platforms, identity providers, endpoint detection and response (EDR), REST APIs, and authentication.
Experience with infrastructure-as-code tools.
Experience with Git-based collaborative development, including branching, pull requests, and code review.
Experience building and maintaining production CI/CD pipelines.
Understanding of the software development lifecycle and application design, and a habit of writing maintainable, tested code.
Familiarity with secure development practices such as dependency scanning, secrets scanning, and managing secrets in pipelines.
Clear written communication for runbooks, incident timelines, and audit evidence.
Must be able to pass a standard FBI background check for access to Criminal Justice Information Systems.

Responsibilities

Investigate and respond to security alerts, security tickets, and user-reported phishing through the shared queue rotation.
Participate in the on-call rotation and investigate, contain, and coordinate escalated security events, including exposed credentials, data spillage, suspicious account activity, and cloud account compromise.
Own incidents through closure, documenting timelines, root cause, remediation tracking, and updates to detections or playbooks.
Identify repetitive manual tasks and automate work such as phishing triage and enrichment, offboarding verification, vulnerability remediation tracking, and bulk ticket handling.
Write, tune, and document detections against security logs, retire noisy alerts, and create a runbook for each alert shipped.
Support identity and access operations, including offboarding, access requests, and access reviews, and automate reliability checks.
Produce audit and compliance evidence and automate its collection where possible.
Design, build, and operate security automation using version control, code review, testing, and CI/CD, including playbooks, chat-based workflows, and services connecting security tools.
Integrate security, identity, IT service management, and cloud platforms through APIs, handling authentication and secrets securely.
Own the detection lifecycle by onboarding log sources, writing and tuning detections, finding coverage gaps, and managing detections as code.
Deploy and maintain cloud infrastructure behind security tooling using infrastructure-as-code and least-privilege design.
Build detections and automation that meet strict data-handling and compliance requirements.
Turn incident lessons into reusable playbooks, templates, and tooling that make response consistent across the team.
Evaluate security tooling, including automation platforms and AI-assisted triage, for fit, security, and licensing, and take selected tools into production.
Measure team workload and time saved through automation, and report metrics to inform investment priorities.
Partner with senior team members on platform design decisions and assist more junior team members with scripting and automation.