Security Operations Engineer

Collaborative Solutions•Jersey City, NJ

4d•Hybrid

About The Position

Collectors is seeking a Security Operations Engineer to join its Cybersecurity team and partner with Product and Technology teams to build secure-by-default architectures and protect the security and integrity of its infrastructure. The role focuses on security operations across cloud, SaaS, identity, and on-premises environments, including detection engineering, incident response, threat hunting, automation, and security telemetry. The position is based at the Santa Ana, California office, with remote or hybrid candidates also considered. Employees living within a one-hour commute of an office are expected to work onsite most of the time; the arrangement will be discussed during recruiting. The role participates in a shared on-call rotation. Collectors creates technology and services for collectors, including grading, authentication, vaulting, and sales across trading cards, autographs, comic books, coins, video games, event tickets, and memorabilia. The company employs more than 3,000 people and operates offices in multiple countries. Its engineering organization emphasizes customer experience, innovation, collaboration, and continuous learning. The salary range is $140,971–$228,870. Compensation varies based on factors such as location, job level, experience, and skill set. The position may also be eligible for bonuses, commissions, or other compensation.

Requirements

At least 5 years of experience in security operations, incident response, or detection engineering, including at least 2 years operating in a cloud-native environment at a senior level.
Deep hands-on experience securing AWS at scale, including IAM, CloudTrail, GuardDuty, Security Hub, EC2, EKS, and Lambda in a multi-account organization.
Strong SIEM proficiency, including building and tuning detections, writing complex queries, and managing log pipelines.
Proficiency in one or more general-purpose programming or scripting languages; Python is preferred. Must be comfortable building automation, integrations, and SOAR playbooks from scratch.
Incident response experience, with the ability to remain calm under pressure, communicate clearly with technical and executive audiences, and lead without formal authority.
Understanding of attacker tradecraft, MITRE ATT&CK, and cloud-specific attack paths, and ability to use this knowledge to prioritize work.
Experience working across teams, influencing engineering roadmaps, negotiating with vendors, and representing security operations in cross-functional forums.
Pragmatic, outcome-driven approach that balances security goals with operational realities.
Excellent problem-solving skills and ability to work independently and handle multiple tasks.
Familiarity with major compliance frameworks such as PCI, NIST, ISO, and SOX, and experience assisting in audits.
Authorization to work in the United States.

Nice To Haves

Familiarity with GCP or Azure.

Responsibilities

Build, tune, and manage high-confidence detections across AWS/GCP, enterprise tools such as Okta, Google Workspace, and Microsoft 365, and vendor products.
Manage detections as code using version control, peer review, CI testing, and measurement of precision and coverage against MITRE ATT&CK.
Serve as a senior incident responder, leading triage, containment, forensics, and remediation, and write post-incident reviews that drive lasting improvements.
Conduct proactive threat hunts across cloud, SaaS, identity, and on-premises infrastructure, turning findings into detections and strengthened controls.
Design and build automation and SOAR playbooks to reduce manual work, accelerate response, and improve alert enrichment and case management.
Own and improve security data pipeline health, including log-source onboarding, parser and schema quality, coverage gap analysis, and data quality across cloud, SaaS, and on-premises sources.
Integrate automation to identify, prioritize, and remediate vulnerabilities.
Partner with infrastructure, platform, and engineering teams to embed security operations requirements into new services and cloud architecture decisions.
Champion company policies, including safety, attendance, and security.
Participate in a shared on-call rotation and improve runbooks, escalation paths, and alert quality to make on-call sustainable for the team.