Senior Security Operations Engineer

Fleetio

4d•Remote

About The Position

Fleetio’s Business Technology team is seeking a Senior Security Operations Engineer to own security for the tools, devices, identities, and data used by Fleetio employees. The role runs corporate security operations across detection and response, identity, endpoint, email and SaaS security, data loss prevention, AI security, and vulnerability management. It is hands-on and focused on engineering controls, developing and tuning detections, automating response, and closing security gaps. The role engineers the environment monitored by Fleetio’s external SOC, CrowdStrike Falcon Complete, owns escalations, and extends the SOC’s visibility. It works closely with IT Operations, Compliance, the third-party SOC, and Product Security in Platform Engineering. AI agents and automated workflows are part of the team’s approach to reducing toil and accelerating investigation and response. The position is remote-friendly.

Requirements

At least 5 years of experience in security operations, detection and response, or security engineering; experience at a SaaS company is preferred in the posting’s description of the ideal background.
Experience with detection engineering and threat hunting in a SIEM such as CrowdStrike Next-Gen SIEM or a similar product.
Experience building SOAR playbooks, such as in CrowdStrike Fusion or a similar platform, that connect identity, endpoint, email, and SaaS tools into a unified response flow; experience with Python or PowerShell and REST APIs.
Incident-response experience from initial triage through forensics, root cause analysis, and follow-up across cloud, identity, and SaaS environments, including work with an MDR or managed SOC provider.
Identity-security experience with Okta or a similar provider, including authentication policy, privileged access, and access reviews in a SOC 2 or ISO 27001 control environment.
Endpoint-security experience with CrowdStrike or a similar product, including macOS, device trust, and endpoint query tooling.
Experience with email security such as Mimecast or similar and SaaS security posture management.
Experience designing and operating a DLP program, including data classification, policy design and tuning across email, cloud collaboration, and endpoints, and investigating data exposure.
Experience securing developer tooling and the software supply chain, including IDE extensions, package registries, and AI coding tools.
Excellent written and verbal communication skills, including the ability to explain risk to non-technical leaders.

Nice To Haves

Experience securing organizational use of AI, including AI tool governance, agent identity and access, data-exposure and prompt-injection risks, and AI detection and response tooling such as CrowdStrike Falcon Guardian/AIDR or similar.
Experience building AI agents, LLM-powered automations, or integrations for security operations workflows, such as using tool/function calling or MCP.
Experience using LLMs on real security alerts for triage, enrichment, and investigation.

Responsibilities

Own detection engineering and threat hunting in CrowdStrike Next-Gen SIEM, including onboarding log sources and writing and tuning detections across identity, email, SaaS, and endpoint telemetry while reducing false positives.
Build and maintain security automations using CrowdStrike Fusion SOAR and workflow automation, connecting signals across security tools to trigger enrichment, containment, paging, and ticketing; use AI agents to accelerate triage and investigation.
Lead corporate incident response as technical lead, including third-party and supply-chain incidents; scope exposure, investigate possible compromise, conduct forensics, communicate guidance to leaders and employees, maintain runbooks with Product Security, and participate in the escalation rotation, backing up the Incident Commander when needed.
Own CrowdStrike Falcon configuration and detections, manage the Falcon Complete relationship and escalations, and maintain device trust checks and inventories of software and extensions on company devices, with guidance on approved tools.
Own Okta authentication, MFA, session policies, and privileged access management; automate user access reviews and audit evidence with Compliance to reduce manual SOC 2 control work.
Own Mimecast policy, secure network access, Google Workspace and key SaaS security settings, and SaaS security posture in CrowdStrike Falcon Shield; work with app owners to close findings.
Own data loss prevention, including defining and classifying sensitive data, designing and tuning policies across email, Google Workspace, endpoints, and key SaaS apps, and investigating and responding to data exposure.
Own security for Fleetio’s use of AI, including visibility into AI tool usage, identity and access for AI agents, guardrails for internal agents and automations, and AI detection and response using CrowdStrike Falcon Guardian, formerly AIDR.
Run vulnerability management for corporate assets, prioritize issues by exploitability, hold owners to remediation deadlines, and report clear, honest security-posture metrics to inform program priorities.

Benefits

Multiple health and dental coverage options (100% coverage for employee, 50% for family).
Vision insurance.
Incentive stock options.
401(k) match of 4%.
Four weeks of PTO, increasing at year two.
12 company holidays and 2 floating holidays.
Paid parental leave: 16 weeks for birthing parents and 4 weeks for non-birthing parents.
FSA and HSA options.
Short- and long-term disability; short-term disability is 100% paid.
Community service funds.
Professional development funds.
Wellbeing fund of $150 quarterly.
Business expense stipend of $125 quarterly.
Mac laptop and new-hire equipment stipend.
Fully stocked kitchen with drinks and snacks (BHM only).