Security Operations Engineer

Alchemy•New York, NY

About The Position

Alchemy is seeking a hands-on individual-contributor Security Operations Engineer to improve threat detection, incident investigation, and operational security risk reduction. The role has no people-management responsibilities. The engineer will investigate suspicious activity and build systems and workflows that make investigations faster and more reliable, using AI-assisted engineering and investigation as part of daily work. They will also help teammates build independent capabilities through shared tooling, code review, pairing, and practical documentation. The role spans threat detection and hunting across cloud infrastructure, corporate systems, identity, endpoints, and production environments; detection engineering and log pipeline reliability; incident response and security on-call; AI-assisted investigation and response workflows; vulnerability remediation and infrastructure hardening; controls for agent identities and tools; and measuring defensive outcomes. The engineer is expected to validate AI-assisted outputs against evidence and known cases, keep human approval for disruptive containment actions, and communicate investigative uncertainty clearly. Success means reaching evidence-backed investigative conclusions faster, improving detection coverage and alert quality, reducing repeat noise, verifying remediation, and enabling the team to adopt tested tools and workflows with clear limits and failure-handling paths.

Requirements

Hands-on security operations experience spanning detection engineering, threat hunting, and incident response.
Strong scripting and software-building ability, especially Python; experience with APIs, version control, tests, and operating automation in production.
Experience with a SIEM such as Panther, Splunk, or an equivalent platform, including detection logic and log analysis.
Working knowledge of cloud security, identity, endpoint telemetry, networking, and Linux systems.
Ability to investigate across system boundaries.
Experience building and using AI-assisted tools in security or adjacent engineering work, with the ability to explain how outputs are validated, failures are handled, and sensitive information is protected.
Sound incident judgment, including distinguishing hypotheses from findings, preserving evidence, and choosing when to escalate or contain.
A record of making teammates more effective through tools, mentoring, code review, or documentation, without requiring management authority.
Clear written communication and willingness to own urgent investigations and follow-through that prevents repeat incidents.

Nice To Haves

Experience with AWS, Kubernetes, bare-metal infrastructure, detection-as-code, or SOAR workflows.
Digital forensics, threat intelligence, or testing detections through attack simulation.
Experience securing AI agents and tool integrations, including prompt injection, credential misuse, and data-exfiltration risks.
Blockchain infrastructure experience or experience in other environments with sensitive keys and high-impact production systems.

Responsibilities

Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments; establish what happened from evidence and communicate uncertainty clearly.
Build and tune detections, onboard useful telemetry, maintain reliable log pipelines, test rules against representative attacks and benign activity, and address coverage gaps and noisy alerts.
Participate in the security on-call rotation and incident response, including scoping, containment, recovery, and post-incident improvements; preserve evidence and coordinate changes with system owners.
Automate evidence collection, alert enrichment, investigation timelines, and response preparation using AI-assisted workflows connected to approved tools and data sources, with traceable results.
Evaluate AI-assisted workflows against known cases and adversarial inputs; require evidence for conclusions, test false-positive and missed-threat behavior, and keep human approval for disruptive containment actions.
Partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls, and attack-surface monitoring; prioritize findings by exposure and impact and verify remediation.
Work with platform and product-security partners on operational controls for agent identities, credentials, tool access, and audit logging; investigate misuse and build detections for suspicious agent behavior.
Share reusable code, investigation skills, runbooks, and evaluation cases; pair with teammates, review automation, and teach approaches teammates can apply independently.
Track detection coverage, alert quality, investigation effort, response time, and remediation progress, and use those measures to determine what to improve.