Cloud Security Operations Engineer

Gainsight; México; Remote; MXN 900,000 - 1,500,000; Full time

Benefits offered by this job

Corporate performance bonus

Aguinaldo (Christmas bonus)

Remote benefits package (medical, etc)

Local statutory benefits

Job summary

Gainsight is seeking a remote Cloud Security Operations Engineer in Mexico to strengthen cloud detection and response across multi-cloud environments. You’ll lead incident investigations and build tooling to improve team effectiveness.

The role requires 4+ years in security engineering or SOC/IR, strong cloud security knowledge, and hands-on experience with SIEM and cloud logs. Collaboration with engineering and stakeholders is essential; travel up to 10–20% may be required.

Qualifications

• 4+ years in security engineering, SOC ops, or incident response in a complex enterprise
• 3+ years defending production cloud workloads
• Bachelor's degree or equivalent experience
• Strong cloud security architecture knowledge and telemetry
• Deep IAM understanding and incident response experience
• Hands-on with cloud-native logs and forensics
• Experience with cloud-native threat detection services and SIEM
• Proficient in Python/PowerShell/Bash scripting
• Certs: GCIH, GCFE, GCIA, GCDA, OSCP, AWS/GCP security certs

Responsibilities

• Triage and investigate cloud alerts end-to-end across tooling; determine severity and close with findings
• Detect and respond to cloud threats, including identity compromise and misconfigurations
• Build detections on CloudTrail, Cloud Audit Logs, and related logs
• Run proactive threat hunts using ATT&CK-aligned methods
• Automate cloud containment actions and runbooks
• Lead incident response from scoping to post-incident review with cross-functional teams
• Maintain SIEM rules and detection-as-code pipelines
• Ensure health of SecOps tooling estate and on-call participation

Skills

Security engineering

SOC operations

Incident response

Cloud security architecture

IAM and attack paths

Threat detection tooling

SIEM tuning

MITRE ATT&CK

Digital forensics

Python/PowerShell/Bash

Cloud provider logs

Education

Bachelor's degree or equivalent experience

Tools

GuardDuty

Sentinel

Security Command Center

CloudTrail

Entra ID logs

GCP Cloud Audit Logs

XSOAR/SOAR

Sigma detection

Job description

We’re building the AI-driven future of customer success, from retention to growth!

We’re building the AI-driven future of customer success, from retention to growth! Gainsight is the AI-powered retention engine behind the world’s most customer-centric companies. The Gainsight CustomerOS platform orchestrates the customer journey from onboarding to outcomes to advocacy. More than 2,000 companies trust Gainsight’s applications and AI agents to drive learning, adoption, community connection, and success for their customers. To explore how our suite of solutions is shaping the future of customer success, check out the link.

About This Role:

We’re looking for a full-time Cloud Security Operations Engineer to join our Security team reporting to the Senior Manager, AI Response & Threat. This role is a remote role based in Mexico.

In this role, you’ll play a key role in strengthening our cloud detection and response practice by defending multi-cloud environments, building cloud detection coverage, leading incident investigations, and developing the tooling and processes that make the team more effective. This is a great opportunity for someone who thrives in a complex enterprise environment and enjoys working cross-functionally with teams like engineering and technical and non-technical stakeholders. The ideal candidate brings strong skills in cloud security operations, incident response, and SIEM detection engineering.

What You’ll Do:

• Triage and investigate alerts end-to-end across cloud-native tooling (GuardDuty, Sentinel, Security Command Center), determining severity and scope and closing with documented findings

• Detect and respond to cloud-specific threats, including identity compromise, privilege escalation, access key and token abuse, misconfiguration exploitation, and data exfiltration from cloud storage

• Build detections on cloud audit logs (CloudTrail, Azure Activity and Entra ID logs, GCP Cloud Audit Logs), network flow logs, and container and workload telemetry

• Run proactive threat hunts using ATT&CK-aligned methods, including the Cloud and Containers matrices, to surface attacker activity that automated detection has missed

• Build automation for cloud containment actions, such as credential revocation, instance isolation, and policy quarantine

• Lead incident response from scoping and containment through post-incident review, performing forensics across cloud, host, network, and memory, and reporting clearly to technical and non-technical stakeholders

• Build, tune, and maintain SIEM correlation rules and Sigma-based detection-as-code pipelines that reduce noise and improve signal quality

• Own the health and reliability of the SecOps tooling estate, including SIEM, EDR, SOAR, and log ingestion pipelines, with responsibility for coverage, integration uptime, and vendor escalation

• Participate in the on-call rotation, maintain operational runbooks, and contribute to red and purple team exercises

This role may require occasional travel (up to 10-20%) for team meetings, training, or company events. This is not a complete list of responsibilities, and the scope of the role may evolve with the needs of the team and business.

What We’re Looking For:

• 4+ years in security engineering, SOC operations (T2/T3), or incident response within a complex enterprise environment, including 3+ years defending production cloud workloads

• Bachelors Degree (or equivalent experience) and/or 5 years of related experience

• Strong knowledge of cloud security architecture and telemetry in at least one major provider (AWS, Azure, or GCP), including the log sources needed for effective detection and investigation

• Deep understanding of cloud IAM and identity-based attack paths, such as role assumption abuse, federation weaknesses, and long-lived credential compromise

• Hands-on experience investigating real cloud incidents using native cloud logs and forensic acquisition methods

• Experience with cloud-native threat detection services and with ingesting and normalizing cloud logs in a SIEM

• Working knowledge of core cloud infrastructure (compute, storage, networking, and serverless) sufficient to assess risk and advise on remediation

• Advanced proficiency with an enterprise SIEM, including detection authoring, correlation rules, pipeline administration, and tuning to reduce false positives at scale

• Working command of MITRE ATT&CK to map detections to technique coverage, identify telemetry gaps, and design hunts against specific adversary behaviors

• Digital forensics experience across host, network, and memory artifacts, including memory acquisition, disk imaging, and multi-source timeline correlation

• Scripting in Python, PowerShell, or Bash, with production automation, log enrichment, or tooling integrations to show for it

• Relevant Professional Certifications: GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer

Nice-to-have skills or experience:

• CSPM/CNAPP or cloud workload protection experience (Wiz, Prisma Cloud, Defender for Cloud, Orca)

• Experience in multi-cloud environments

• Container and Kubernetes security (EKS, AKS, GKE), including runtime threat detection and image scanning

• IaC for cloud guardrails and security configuration (Terraform, CloudFormation)

• SOAR experience (XSOAR, Splunk SOAR, Torq), including playbook development, API integrations, and case management

• Detection-as-code workflows with CI/CD integration and automated rule validation

• Relevant Professional Certifications: GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer

Why You’ll Love It Here:

Gainsight is a place where innovation is shaped through collaboration, curiosity, and a shared focus on solving real-world problems. With a growing suite of products across customer success, product experience, community, education, and AI-powered relationship intelligence, we continue to evolve with the needs of our customers. When people with diverse strengths, a strong sense of community, and true passion for our mission come together, they drive greater impact and create lasting value. What underpins it all is a culture that offers the stability, trust, and support that people need - not just to do the job, but to show up as themselves and feel connected to the work they do. Gainsters love working here for several reasons. Here are a few:

Our benefits:

• We offer a comprehensive benefits package including a corporate performance bonus and a Christmas bonus (Aguinaldo) per local requirements.
• Benefits are administered through Remote, including medical, dental, vision, and other local statutory benefits.

Our Core Values

We are guided by our values and our mission to be living proof you can win in business while being Human-First. Learn morehere.

Our Growth Opportunities

From mentoring to career development opportunities, we’re passionate about helping our teammates learn, grow, and thrive.

Our Parody Videos

No explanation needed. Just watch themhere!

If this sounds like the right role for you, we’d love to hear from you.

Additional Information:

We’re committed to creating an inclusive, fair, and transparent hiring process. As an equal opportunity employer, we celebrate diversity and are committed to creating a welcoming experience for all candidates.

If you require accommodations or have questions about how your personal data will be used during the hiring process, please contact [e-mail].

If you’re applying for a role through an Employer of Record (EOR) or contractor arrangement, please note that employment terms and benefits are managed by the EOR or may not apply to non-EOR contractors.