Staff Security Engineer - Detection & Response

Job Summary

Your goal to improve the education process and better the lives of students by keeping their data secure.

What you will do

• Triage and investigate alerts from our SIEM/UEBA, endpoint detection and response, cloud, and email security platforms to determine whether indicators of compromise represent a real intrusion
• Declare, lead, and manage security incidents end to end endpoint compromise, cloud and infrastructure compromise, credential theft, phishing, and insider risk through containment, eradication, and recovery
• Own written incident documentation, including timelines, root cause analysis, and post-incident reviews that drive durable fixes rather than one-off cleanup
• Build, tune, and maintain detection content to expand coverage of real attacker behavior while reducing false positives and alert fatigue
• Develop and maintain incident response playbooks and runbooks
• Between incidents, contribute to security engineering work: deploying and operating security tooling in our cloud environment, closing logging and telemetry gaps, and automating response actions
• Partner with IT, engineering, and cloud platform teams to drive remediation of identified weaknesses to closure

What you ll bring

• 7+ years of relevant work experience, with significant time spent in security operations, detection and response, or incident response
• Hands-on experience investigating alerts across SIEM/UEBA and endpoint detection and response tooling, and separating true positives from noise at volume
• Demonstrated experience leading incident response from detection through recovery, including coordinating responders and stakeholders across teams
• Strong understanding of attacker tradecraft and common attack paths across endpoint, identity, network, and cloud, and familiarity with a framework such as MITRE ATTCK
• Working knowledge of security in cloud environments, ideally AWS, including identity, logging, and the misconfigurations attackers most often abuse
• Experience writing and tuning detection logic, correlation rules, or queries against large log data sets
• Scripting and automation ability, such as Python, and comfort working with open-source tools and APIs to connect systems and remove manual effort
• Practical familiarity with Windows, macOS, and Linux internals, and the forensic artifacts each produces during an investigation
• Sound judgment and composure under pressure, including the ability to make decisions with incomplete information
• Excellent written and oral communication skills, including the ability to explain an incident clearly to both engineers and executives
• Ability to work independently and with various other teams across the organization
• Creative, resourceful, and adaptive problem solving

Stand Out Qualifications

• Experience with a SIEM or UEBA platform such as Exabeam, and an endpoint detection and response platform such as SentinelOne
• Experience working in AWS with features such as GuardDuty, CloudTrail, Security Hub, Inspector, IAM, WAF and Shield
• Experience managing detection content as code, under version control and peer review
• Familiarity with SOAR platforms and automated response workflows
• Digital forensics, malware analysis, or reverse engineering experience
• Experience working with container technologies including Docker and Kubernetes
• Relevant certifications such as GCIH, GCIA, GCFA, OSCP, or AWS Certified Security - Specialty

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.