Security Operations Engineer

Astranis•San Francisco, CA

2h•$150,000 - $205,000•Onsite

About The Position

Astranis is looking for a Security Operations Engineer who isn’t afraid to dive headfirst into the digital abyss. Our ideal candidate is a seasoned defender with the technical depth to not only triage complex threats but to oversee the very systems that keep us secure. As a Tier 2/3 escalation point, you will be the backbone of our defense, untangling advanced malware, neutralizing sophisticated phishing schemes, and leading high-stakes incident response operations. In an environment where threats evolve at breakneck speed, we need a resourceful engineer who can engineer resilience, mentor junior analysts, and protect our digital frontier with precision.

Requirements

3–5 years of experience in a dedicated security operations or engineering role.
Proven track record of handling complex escalations and leading incident response efforts.
Advanced experience in malware analysis, digital forensics, and neutralizing sophisticated phishing campaigns.
Strong understanding of security standards, hardening principles, and the ability to oversee enterprise-grade security platforms.
Exceptional analytical skills with the ability to think like an attacker to better defend the system.
Excellent written and oral communication skills, with the ability to translate technical findings into actionable leadership briefings.
While we value experience, a degree in CS, Cybersecurity, or a related field is a plus.

Nice To Haves

Advanced certifications such as CISSP, GCIA, GCIH, or OSCP.
Hands-on experience managing and tuning Google SecOps (Chronicle).
Experience with SOAR platforms or scripting (Python, Go) to automate response workflows.

Responsibilities

Act as the Tier 2/3 escalation point for complex security events.
Investigate and resolve high-severity incidents escalated from initial monitoring tiers.
Oversee and optimize security infrastructure, ensuring that Google SecOps (Chronicle) and other SIEM/SOAR tools are tuned for maximum visibility and efficiency.
Lead the charge during active incident response operations, coordinating across teams to contain threats and performing deep-dive post-incident forensics.
Perform deep-tissue analysis of malware to understand behavior and origins, using that intelligence to build proactive technical controls.
Create, integrate, and maintain custom security tools and automated playbooks to streamline the "detect-to-remediate" lifecycle.
Investigate advanced phishing vectors and implement systemic preventive measures; assist in high-level purple team exercises to validate our posture.
Maintain and mature security documentation, including technical procedures, complex runbooks, and internal security policies.