Staff Security Engineer, Security Operations
About The Position
The Staff Security Engineer, Security Operations is responsible for protecting GoodLeap’s cloud environments, applications, endpoints, and corporate systems through detection engineering, incident response, and security operations. The role builds and tunes detections, leads security incident investigation and response, and manages security tooling that provides visibility across cloud, identity, endpoint, and email. It also designs and builds AI agents and automation to reduce time-to-detect and time-to-respond, and establishes monitoring of enterprise AI activity, including tools, agents, and integrations used by employees and engineering teams. The position partners with software engineering, infrastructure, IT, and compliance teams to ensure security controls are consistently applied and operationally effective. It develops security requirements, conducts risk assessments, evaluates security services and technologies, maintains incident response plans and runbooks, and mentors security and partner engineering teams. The role owns endpoint detection and response (CrowdStrike) and email security as these capabilities are brought into the security function.
Requirements
- In-depth knowledge of Amazon AWS, including security configuration, logging, and tooling such as CloudTrail, GuardDuty, and Security Hub.
- Hands-on experience in detection engineering, including SIEM query languages and detection-as-code.
- Hands-on experience in incident response, including log analysis and host and cloud investigation.
- Familiarity with the MITRE ATT&CK framework and OWASP Top 10.
- Knowledge of network and web protocols such as TCP/IP, DNS, HTTP, HTTPS, and TLS.
- Experience with, or ability to quickly ramp on, EDR platforms.
- Experience with, or ability to quickly ramp on, email security, including phishing, BEC, DMARC, SPF, and DKIM.
- Experience building automation in Python or a similar language.
- Experience building or integrating LLM-based agents and workflows.
- Understanding of AI-specific risks such as prompt injection, data leakage, and excessive agent permissions.
- Experience working in a SOC 2, PCI-DSS, or ISO control environment.
- Ability to combine business acumen, technical acumen, and process expertise to assess requirements and alignment.
- Strong verbal, written, ticketing, and messaging communication skills.
- Ability to prioritize and deliver multiple tasks independently, with a strong bias toward action in a fast-paced environment.
Nice To Haves
- CrowdStrike Falcon experience is preferred.
- GCIH, GCFA, GCDA, CCSP, CISSP, CrowdStrike, or comparable certifications are a plus.
Responsibilities
- Design, build, test, and tune detections across cloud, identity, endpoint, and email telemetry using detection-as-code practices mapped to MITRE ATT&CK.
- Manage security logging, SIEM, and alerting pipelines.
- Establish monitoring of AI tools, agents, MCP integrations, and API keys to detect data exposure, misuse, and anomalous behavior.
- Reduce time-to-detect through applied threat intelligence and sensor enrichment.
- Lead investigation, containment, eradication, and recovery for security incidents.
- Serve as incident lead for significant events and coordinate with legal, compliance, and leadership on regulatory notification obligations.
- Maintain incident response plans, playbooks, and runbooks.
- Conduct tabletop exercises and post-incident reviews that drive lasting control improvements.
- Deploy and manage security operations tools, including cloud security monitoring, WAF, DDoS protection, IDS, EDR (CrowdStrike), and email security.
- Build AI agents and automation for alert triage, enrichment, investigation, and response.
- Review vulnerability scan results, penetration testing, and other findings for true positives; propose remediation or mitigating controls.
- Serve as a subject matter expert on AWS cloud security and consult on secure design of cloud-based systems.
- Mentor and guide the security team and partner engineering teams on detection, response, and security operations practices.
- Share in-depth understanding of company and industry methodologies, policies, standards, and controls.
- Help build the security team and lead efforts to mature GoodLeap’s security operations capability.
- Develop security requirements, conduct security risk assessments, and evaluate security services and technologies.
Benefits
- The role may be eligible for a bonus and equity.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
