Security and Threat Operations Engineer

Responsibilities

• Build and tune detections, alerts, and monitoring workflows across cloud, application, identity, and edge environments.
• Analyze API, authentication, and WAF traffic telemetry to identify malicious activity, abuse, and anomalous behavior.
• Use AI for security triage, analysis, and workflow automation while helping define guardrails for AI-enabled systems.
• Operate vulnerability management workflows by triaging, prioritizing, and driving remediation of findings from Wiz and vulnerability scans.
• Develop Python tooling and automation for investigations, enrichment, response, and operational scale.
• Translate threat models, security reviews, and product risks into production detections and response playbooks.
• Investigate security events through triage, scoping, containment support, and remediation follow-through.
• Support operational security practices aligned with PCI and SOC 2 expectations.
• Conduct proactive threat hunting and detection improvements, and participate in a 24x7 security incident response on-call rotation.

Requirements

• 5+ years of experience in information security, threat detection, security operations, detection engineering, or incident response.
• Strong experience investigating web, API, authentication, and infrastructure telemetry and distinguishing attacker behavior from normal production activity.
• Experience identifying fraud, account abuse, credential attacks, reconnaissance, exploitation attempts, and other malicious behavior.
• Strong Python programming skills for automation, enrichment, analysis, and security operations tooling.
• Experience building and tuning detections in a SIEM or detection platform and working with systems such as CloudWatch or Datadog.
• Experience operating or supporting vulnerability management programs, including triage, prioritization, remediation tracking, and stakeholder coordination.
• Familiarity with cloud and application security findings from platforms such as Wiz, including CNAPP, runtime, code, and vulnerability scanning use cases.
• Experience with at least one major cloud provider, preferably AWS.
• Working knowledge of identity and access systems, modern authentication flows, and security risks affecting internet-facing applications and APIs.
• Strong understanding of threat modeling, risk prioritization, and practical security controls across applications, infrastructure, and cloud environments.
• Practical experience using AI tools in security workflows and understanding risks including prompt injection, data leakage, excessive tool access, and weak auditability.
• Strong analytical, communication, and cross-functional collaboration skills.

Benefits

• Competitive base salary, stock options, and health benefits from Day 1.
• 401(k) plan with company match.
• Remote-friendly work arrangement in the US.
• Flexible time off and opportunities for growth.
• Mission-driven, inclusive, high-growth culture.