Senior Security Operations Engineer - Hybrid Threat Hunting

Medallia; Buenos Aires; Hybrid; ARS 184,482,000 - 276,723,000; Full time

Job summary

Medallia is seeking a Senior Security Operations Engineer to fortify detection and response across SIEM, SOAR, EDR, and cloud environments. You will partner with global engineering teams to improve threat hunting, automation, and incident readiness while delivering scalable security controls and governance.

You will lead investigations, mentor engineers, and help shape security standards, with a focus on hybrid work in the Buenos Aires area. Fluency in English is required.

Qualifications

• 5+ years of experience in Security Operations, Detection Engineering, Incident Response, Threat Hunting, Security Engineering, or related cybersecurity disciplines.
• Demonstrated experience building and maintaining detections within SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, Elastic, or similar technologies.
• Demonstrated experience developing automation and orchestration workflows using SOAR platforms such as Cortex XSOAR, Splunk SOAR, Tines, or equivalent.
• Demonstrated experience investigating security incidents involving cloud platforms, endpoints, identities, applications, and network infrastructure.
• Scripting or programming experience in Python, Go, Bash, PowerShell, or similar languages.
• Demonstrated experience working with Linux systems, cloud platforms (AWS, Azure, GCP, OCI), and containerized environments.
• Demonstrated knowledge of common attack frameworks and methodologies such as MITRE ATT&CK, Cyber Kill Chain, and modern adversary tradecraft.
• Demonstrated experience utilizing Infrastructure‑as‑Code tools such as Terraform, CloudFormation, or similar technologies.
• English proficiency, both oral and written.

Responsibilities

• Design, develop, and maintain advanced detection and response capabilities across SIEM, SOAR, EDR, cloud, identity, endpoint, and application environments.
• Build, tune, and continuously improve detection use cases to identify malicious activity, insider threats, advanced persistent threats (APTs), misconfigurations, and anomalous behavior.
• Lead investigations into security incidents, indicators of compromise, and suspicious activity, performing root cause analysis and driving containment, eradication, and remediation efforts.
• Develop and maintain security automation, orchestration, and response workflows to improve operational efficiency and reduce manual effort.
• Translate threat intelligence, emerging attack techniques, and industry trends into actionable detections, hunting hypotheses, and security controls.
• Build and operate security platforms using Infrastructure‑as‑Code and automation‑first principles leveraging technologies such as Terraform, Kubernetes, Linux, Git, Python, and cloud‑native services.
• Conduct proactive threat hunting activities across cloud, endpoint, identity, network, and application environments.
• Partner with Engineering, Infrastructure, IT, Product Security, and other stakeholders to improve visibility, security posture, and incident readiness.
• Participate in the Security Operations on‑call rotation and act as an escalation point for complex incidents.
• Mentor junior engineers and contribute to the development of team standards, documentation, and operational processes.
• Leverage automation and AI‑assisted capabilities to improve threat detection, investigation, and response processes while maintaining appropriate governance and security controls.

Skills

Security Operations

Detection Engineering

Incident Response

Threat Hunting

Security Engineering

Python

Go

Bash

PowerShell

Linux

Cloud Platforms

MITRE ATT&CK

Terraform

CI/CD / DevSecOps

Tools

Splunk

Microsoft Sentinel

QRadar

Elastic

Cortex XSOAR

Splunk SOAR

Tines

Terraform

CloudFormation

Kubernetes

Job description

Medallia is seeking a Senior Security Operations Engineer to fortify detection and response across SIEM, SOAR, EDR, and cloud environments. You will partner with global engineering teams to improve threat hunting, automation, and incident readiness while delivering scalable security controls and governance.

You will lead investigations, mentor engineers, and help shape security standards, with a focus on hybrid work in the Buenos Aires area. Fluency in English is required.