Staff Security Engineer

Guardant Health

9d•$133,960 - $184,195•Remote

About The Position

The Staff Security Engineer reports to the Associate Director of Security Engineering and strengthens Guardant Health’s ability to detect, investigate, and respond to threats. The role focuses on detection engineering, threat intelligence, security automation, and incident response across infrastructure, cloud, endpoint, and identity security. This is a hands-on technical leadership role spanning Security Operations and Security Engineering. The engineer will build scalable logging pipelines, modernize the SIEM, develop high-fidelity detections, and respond to incidents. The role will also help shape the company’s approach to AI-powered defense, including securely logging, monitoring, and assessing AI and agent activity across the enterprise. The position is listed as Remote – Open Position (USA). For U.S. employees living within 50 miles of a Guardant facility, the company requires onsite work Mondays, Tuesdays, and Thursdays, with work-from-home days for individual-focused work, subject to management and related policies. The annualized base salary range is $133,960–$184,195 for the primary and other U.S. locations. For work performed in Colorado, the range is $141,840–$195,030. Compensation offers may vary based on geography, experience, education, skills, job duties, and business need. A background screening, including criminal history, is required. The role may require lifting routine office supplies and using office equipment. Most work is performed in a desk or office environment, with possible exposure to high noise levels, fumes, and biohazard material in the laboratory environment. The employee must be able to sit for extended periods.

Requirements

At least 8 years of experience in security engineering, security operations, detection engineering, or incident response.
Strong hands-on experience developing, testing, and tuning SIEM and EDR detections across multiple environments.
Strong background in threat detection and incident response within a SOC environment.
Experience owning open-source threat intelligence platforms such as MISP, Yeti, and OpenCTI.
Demonstrated ability to improve alert quality, reduce false positives, and incorporate business context into detection and response decisions.
Experience working with external MDR providers, managed SOCs, or SIEM service partners to improve detection content, investigations, escalations, and response outcomes.
Strong incident response experience, including leading technical investigations and coordinating containment, eradication, and recovery activities.
Hands-on experience with EDR platforms.
Experience working with identity and access logs.
Experience investigating threats in AWS environments and working with cloud security telemetry.
Understanding of AI and machine-learning use cases in security, including detection, automation, and governance considerations.
Strong written and verbal communication skills, including the ability to write threat intelligence assessments and reports.
Ability to work independently and collaboratively in a fast-paced environment.
Curiosity, sound judgment, and ability to critically evaluate and responsibly use AI-enabled tools in accordance with company policies, ethical standards, and regulatory requirements.

Nice To Haves

Experience with detection engineering frameworks such as the Diamond Model or MITRE ATT&CK.
Experience in healthcare, biotech, or other regulated environments.
Security certifications such as CISSP, GIAC, GCED, GCIA, or cloud security certifications.

Responsibilities

Develop and maintain high-fidelity threat detection content, including rules, analytics, and behavioral detections across infrastructure, endpoint, cloud, SaaS, and identity platforms.
Own and enhance detection engineering workflows, including testing, tuning, false-positive reduction, and coverage analysis.
Partner with the external MDR provider to develop and refine detection rules, improve investigation quality, and establish effective escalation and response workflows.
Support and participate in incident response, including investigation, containment, eradication, and post-incident reviews.
Build dashboards, metrics, and reports to measure detection coverage, SOC effectiveness, and security posture.
Monitor and help secure AWS and cloud-native environments, including CloudTrail, VPC Flow Logs, workload logs, and SaaS integrations.
Evaluate and implement AI-assisted security capabilities for defense and detection, and define how AI systems, agents, and usage are logged, monitored, and assessed for risk.
Develop documentation, runbooks, and operational playbooks for SOC and security engineering workflows.
Mentor junior engineers and provide technical leadership within SOC and security engineering functions.
Stay current on emerging threats, detection techniques, attacker tradecraft, and security data engineering best practices.