Security Operations Engineer

Alchemy•New York, NY

3d•$160,000 - $180,000

About The Position

Alchemy is seeking a hands-on individual-contributor Security Operations Engineer to improve threat detection, incident investigation, and operational security risk reduction. The role has no people-management responsibilities. The engineer will investigate suspicious activity and build systems that make future investigations faster and more reliable, using AI-assisted engineering and investigation as part of daily work. The role also supports teammates through shared tooling, code review, pairing, and practical documentation. The engineer will work across cloud infrastructure, corporate systems, identity, endpoints, and production environments to investigate threats, build and test detection coverage, maintain telemetry and log pipelines, and participate in incident response. They will automate evidence collection and response preparation using approved tools and data sources, validate AI-assisted workflows against known cases and adversarial inputs, and ensure disruptive containment actions require human approval. The role partners with Infrastructure, IT, platform, and product-security teams to reduce operational exposure, secure agent operations, and verify remediation. It also involves measuring defensive outcomes and sharing reusable tools, investigation practices, runbooks, and evaluation cases. Success means reaching evidence-backed conclusions faster, improving detection coverage and remediation, reducing repeat alert noise, and delivering adopted workflows with clear limits and tested failure handling.

Requirements

Hands-on security operations experience spanning detection engineering, threat hunting, and incident response.
Strong scripting and software-building ability, especially in Python; experience with APIs, version control, tests, and operating automation in production.
Experience with a SIEM such as Panther, Splunk, or an equivalent platform, including detection logic and log analysis.
Working knowledge of cloud security, identity, endpoint telemetry, networking, and Linux systems, with the ability to investigate across system boundaries.
Evidence of building and using AI-assisted tools in security or adjacent engineering work, including validating outputs, handling failures, and protecting sensitive information.
Sound incident judgment, including distinguishing hypotheses from findings, preserving evidence, and deciding when to escalate or contain.
A record of making teammates more effective through tools, mentoring, code review, or documentation without management authority.
Clear written communication and willingness to own urgent investigations and follow-through that prevents repeat incidents.

Nice To Haves

Experience with AWS, Kubernetes, bare-metal infrastructure, detection-as-code, or SOAR workflows.
Experience with digital forensics, threat intelligence, or testing detections through attack simulation.
Experience securing AI agents and tool integrations, including prompt injection, credential misuse, and data-exfiltration risks.
Experience with blockchain infrastructure or other environments involving sensitive keys and high-impact production systems.

Responsibilities

Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments; establish findings from evidence and communicate uncertainty clearly.
Build and tune detections, onboard useful telemetry, maintain reliable log pipelines, test rules against representative attacks and benign activity, and address gaps and noisy alerts.
Participate in the security on-call rotation and incident response, including scoping, containment, recovery, evidence preservation, coordination with system owners, and post-incident improvements.
Automate evidence collection, alert enrichment, investigation timelines, and response preparation using AI-assisted workflows connected to approved tools and data sources, with traceable results.
Evaluate AI-assisted workflows against known cases and adversarial inputs, require evidence for conclusions, test false-positive and missed-threat behavior, and retain human approval for disruptive containment actions.
Partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls, and attack-surface monitoring; prioritize findings by exposure and impact and verify remediation.
Work with platform and product-security partners on operational controls for agent identities, credentials, tool access, and audit logging; investigate misuse and detect suspicious agent behavior.
Share reusable code, investigation skills, runbooks, and evaluation cases; pair with teammates, review automation, and teach approaches teammates can apply independently.
Track detection coverage, alert quality, investigation effort, response time, and remediation progress, and use those measures to determine improvements.