Staff Security Engineer, Security Operations

GoodLeap•Austin, NY

About The Position

The Staff Security Engineer, Security Operations protects GoodLeap’s cloud environments, applications, endpoints, and corporate systems through detection engineering, incident response, and security operations. The role builds and tunes detections, leads security incident investigations and response, and manages tools that provide visibility across cloud, identity, endpoint, and email environments. It also designs AI agents and automation to reduce detection and response times and establishes monitoring for enterprise AI tools, agents, and integrations. Working with software engineering, infrastructure, IT, and compliance partners, this engineer helps ensure security controls are consistently applied and operationally effective. The role develops security requirements, conducts risk assessments, evaluates security services and technologies, maintains incident response plans and runbooks, and mentors security and partner engineering teams. It will own endpoint detection and response (CrowdStrike) and email security as these capabilities transition into the security function.

Requirements

In-depth knowledge of Amazon AWS, including security configuration, logging, and tools such as CloudTrail, GuardDuty, and Security Hub.
Hands-on experience in detection engineering, including SIEM query languages and detection-as-code.
Hands-on incident response experience, including log analysis and host and cloud investigation.
Familiarity with the MITRE ATT&CK framework and OWASP Top 10.
Knowledge of network and web protocols such as TCP/IP, DNS, HTTP, HTTPS, and TLS.
Experience with, or ability to quickly ramp up on, EDR platforms.
Experience with, or ability to quickly ramp up on, email security, including phishing, BEC, DMARC, SPF, and DKIM.
Experience building automation in Python or a similar language.
Experience building or integrating LLM-based agents and workflows.
Understanding of AI-specific risks such as prompt injection, data leakage, and excessive agent permissions.
Experience working in a SOC 2, PCI-DSS, or ISO control environment.
Ability to combine business acumen, technical acumen, and process expertise to assess requirements and alignment.
Strong verbal, written, ticketing, and messaging communication skills.
Ability to prioritize and deliver multiple tasks independently, with a strong bias toward action in a fast-paced environment.

Nice To Haves

CrowdStrike Falcon experience is preferred.
GCIH, GCFA, GCDA, CCSP, CISSP, CrowdStrike, or comparable certifications are a plus.

Responsibilities

Design, build, test, and tune detections across cloud, identity, endpoint, and email telemetry using detection-as-code practices mapped to MITRE ATT&CK.
Manage security logging, SIEM, and alerting pipelines.
Monitor AI activity, including AI tools, agents, MCP integrations, and API keys, to detect data exposure, misuse, and anomalous behavior.
Reduce time-to-detect using threat intelligence and sensor enrichment.
Lead security incident investigation, containment, eradication, and recovery; act as incident lead for significant events.
Coordinate with legal, compliance, and leadership on regulatory notification obligations.
Maintain incident response plans, playbooks, and runbooks; conduct tabletop exercises and post-incident reviews that drive control improvements.
Deploy and manage security operations tools, including cloud security monitoring, WAF, DDoS protection, IDS, EDR (CrowdStrike), and email security.
Build AI agents and automation for alert triage, enrichment, investigation, and response.
Review vulnerability scan, penetration testing, and other findings for true positives and propose remediation or mitigating controls.
Serve as a subject matter expert on AWS cloud security and consult on secure cloud-system design.
Mentor and guide security and partner engineering teams on detection, response, and security operations practices.
Share knowledge of company and industry methodologies, policies, standards, and controls.
Help build the security team and mature GoodLeap’s security operations capability.