Senior Security Operations Engineer

Responsibilities

• Own detection engineering and threat hunting in CrowdStrike Next-Gen SIEM across identity, email, SaaS, and endpoint telemetry.
• Build and maintain security automation that connects identity, endpoint, email, and SaaS tools for enrichment, containment, paging, ticketing, and AI-assisted response.
• Lead corporate incident response, including triage, forensics, root-cause analysis, third-party and supply-chain events, runbooks, and escalation coverage.
• Own CrowdStrike Falcon configuration and detections, the Falcon Complete relationship, device trust checks, and corporate device software and extension inventory.
• Manage Okta authentication, MFA, session policies, privileged access, user access reviews, and audit evidence automation.
• Manage Mimecast, secure network access, Google Workspace, SaaS security posture, and remediation of findings with application owners.
• Design and operate DLP across email, collaboration tools, endpoints, and SaaS applications, including data classification and exposure investigations.
• Own security for Fleetio’s AI usage, including AI tool visibility, agent identity and access, guardrails, and AI detection and response.
• Run vulnerability management for corporate assets and report security posture metrics and remediation priorities.

Requirements

• At least 5 years of experience in security operations, detection and response, or security engineering, ideally in a SaaS company.
• Experience with detection engineering and threat hunting in a SIEM, preferably CrowdStrike Next-Gen SIEM or a similar platform.
• Experience building SOAR playbooks that connect identity, endpoint, email, and SaaS tools, using Python or PowerShell and REST APIs.
• Incident response experience from triage through forensics, root cause, and follow-up across cloud, identity, and SaaS environments, including work with an MDR or managed SOC provider.
• Identity security experience with Okta or a similar provider, including authentication policy, privileged access, and access reviews in SOC 2 or ISO 27001 environments.
• Endpoint security experience with CrowdStrike or a similar platform, including macOS, device trust, and endpoint query tooling.
• Experience with Mimecast or similar email security tools and SaaS security posture management.
• Experience designing and operating DLP programs across email, cloud collaboration, and endpoints.
• Experience securing developer tooling and the software supply chain, including IDE extensions, package registries, and AI coding tools.
• Excellent written and verbal communication skills, including the ability to explain risk to non-technical leaders.
• Preferred experience with AI tool governance, agent identity and access, prompt-injection and data-exposure risks, and AI detection and response tools.
• Preferred experience building AI agents, LLM-powered automations, or security integrations using tool/function calling or MCP.
• Preferred experience using LLMs for security-alert triage, enrichment, and investigation.

Benefits

• Multiple health and dental coverage options, with 100% employee and 50% family coverage.
• Vision insurance, FSA and HSA options, short- and long-term disability coverage, and a 4% 401(k) match.
• Incentive stock options.
• Four weeks of PTO, 12 company holidays, two floating holidays, and paid parental leave.
• Community service, professional development, wellbeing, and business expense funds.
• Mac laptop and new-hire equipment stipend.
• Fully stocked kitchen with drinks and snacks at the Birmingham office.
• Remote-working-friendly arrangement.