Staff Security Engineer, Cloud Detection & Response

Aurora•Mountain View, CA

3d•Hybrid

About The Position

Aurora is seeking a Staff Cybersecurity Engineer to mature Cloud & Enterprise Detection within its Detection & Response team in the Technical Assurance division. This senior individual contributor role leads cross-functional initiatives that strengthen detection infrastructure and expand detection coverage across cloud and enterprise environments. The engineer will scope and lead multi-quarter projects, contributing hands-on and partnering closely with Cloud Infrastructure, IT, and Platform Engineering. The role focuses on developing detection infrastructure, including log ingestion and normalization, detection-as-code pipelines with testing, versioning, and CI/CD, and scalable, cost-aware telemetry collection. It also involves expanding and prioritizing detection coverage, designing and tuning detections, integrating threat intelligence and adversary emulation, proactive threat hunting, and responding to security incidents. The engineer will represent Detection & Response in cross-functional working groups and design reviews, mentor SOC engineers, and contribute to quarterly planning. Aurora expects employees to work from the office at least three days per week; some roles may require up to five days per week based on operational needs. The successful candidate will be eligible for an annual bonus, equity compensation, and benefits.

Requirements

10 or more years of security experience.
Demonstrated experience leading cross-functional security projects or programs from scoping through delivery.
Strong technical foundation in threat detection and incident response.
Expertise in cloud security across one or more major providers, including cloud-native telemetry and detection sources.
Experience building or maturing detection infrastructure, such as SIEM or security data lake pipelines, log onboarding and normalization, and detection-as-code workflows.
Expertise with endpoint detection and response (EDR) and SaaS security monitoring, or comparable depth in host and application telemetry.
Expertise authoring and maintaining detections for anomalous, network, host, identity, or cloud activity, and measuring detection coverage against adversary behavior.
Experience with incident management and driving cross-departmental collaboration for containment and remediation.
Expertise with the MITRE ATT&CK framework and modern adversarial techniques, and understanding of NIST CSF.
Ability to write quality, testable code in Python.

Nice To Haves

Experience designing and implementing Zero Trust Architecture.
Experience scaling a SOC or Detection Engineering with AI/LLM.
Experience building and architecting data lakes.
Experience with compliance frameworks such as SOC 2 and ISO 27001.

Responsibilities

Lead cross-functional projects to mature detection infrastructure, including log ingestion and normalization, detection-as-code pipelines with testing, versioning, and CI/CD, and scalable, cost-aware telemetry collection.
Expand detection coverage across cloud and corporate environments and prioritize coverage improvements.
Design, build, and tune detections for cloud control plane and workload activity, identity-based attacks, endpoint and SaaS threats, CI/CD abuse, and service-to-service communication paths.
Partner with Cloud Infrastructure, IT, and Platform Engineering to incorporate logging and detection requirements into system design.
Represent Detection & Response in cross-functional working groups and design reviews.
Use threat intelligence and adversary emulation to prioritize detection coverage, and conduct proactive threat hunting across cloud, identity, endpoint, and SaaS data.
Respond to cloud and enterprise security incidents and participate in an on-call rotation, applying lessons learned to detection coverage and infrastructure improvements.
Collaborate with and mentor SOC engineers on cloud and enterprise detection practices.
Contribute to quarterly planning for detection infrastructure and coverage initiatives.