Senior Security Operations Engineer

Fleetio; México; On-site; MXN 1,200,000 - 1,800,000; Full time

Job summary

Fleetio is seeking a Senior Security Operations Engineer to own end‑to‑end security for tools, devices, identities and data used daily by Fleetio. You’ll build detections, write response playbooks, and automate security workflows across CrowdStrike, Okta, Mimecast and Google Workspace.

You will work with IT Operations, Compliance and a 3rd party SOC to keep Fleetio secure. The role demands hands‑on engineering, strong incident response leadership, and the ability to drive security decisions with

Qualifications

• Experience building detections and response playbooks.
• Ability to wire tools together to create integrated security workflows.
• Strong incident response and forensics capabilities with calm under pressure.
• Familiarity with AI in security operations and triage automation.
• Ability to communicate risk and decisions clearly to technical and non-technical stakeholders.

Responsibilities

• Own detection engineering for identity, email, SaaS, and endpoint telemetry.
• Own security automation, linking tools to trigger automatic enrichment and containment.
• Lead corporate incident response, including third‑party and supply‑chain events.
• Manage Falcon configuration, detections, and device trust checks.
• Own Okta authentication policy, MFA, and privileged access management processes.
• Own Mimecast policy, Google Workspace security settings, and SaaS posture.
• Define and tune DLP policies across email, endpoints, and SaaS apps.
• Own security for Fleetio's AI usage and agent governance.

Skills

Detection engineering

Threat hunting

Incident response

Security automation

Okta

CrowdStrike

Mimecast

Google Workspace

Data loss prevention

AI security

Tools

CrowdStrike Next-Gen SIEM

CrowdStrike Fusion SOAR

Mimecast

Google Workspace

Okta

Falcon Complete

Job description

More about our team and company:

Fleetio overview video: https://www.youtube.com/watch?v=YoXyXTFWbkg

Our careers page: https://www.fleetio.com/careers

Description

Our Business Technology team is looking for a Senior Security Operations Engineer to own the security of the tools, devices, identities, and data Fleetians rely on every day. You will help run corporate security operations end to end, covering detection and response, identity, endpoint, email, and SaaS security, data loss prevention, AI security, and vulnerability management, and make the day-to-day security calls that keep Fleetio safe.You will be hands-on: engineering controls, writing and tuning detections, automating response, and closing gaps, not just administering tools. The goal is one connected defense, not a collection of consoles: a signal from Okta, CrowdStrike, Mimecast, or Google Workspace should drive action in the others automatically, so the environment protects itself and people step in only where judgment is needed. Around-the-clock monitoring is handled by our external SOC (CrowdStrike Falcon Complete); this role engineers the environment it watches, owns what happens when it escalates, and extends what it can see. You will work closely with our IT Operations and Compliance teams, our 3rd party SOC, and the Product Security team in Platform Engineering.Our team treats AI as a core part of how we work. We build and use AI agents and automated workflows to handle toil, speed up investigation and response, and give our team more time for high-leverage work.

Who You Are

Our ideal candidate is a security engineer who likes to build. You are as comfortable writing a detection or a response playbook as you are working an incident. You think in systems: you see the gaps between tools and close them by wiring the tools together. You make sound security decisions on your own, explain them clearly to technical and non-technical people, and balance risk with how people actually work.You stay calm when something breaks. You can take a vague report, work out quickly what happened and who is affected, and give leaders a clear, evidence-backed answer. Then you fix the root cause so it doesn't happen the same way twice.You're curious about how AI is changing security operations, and you're eager to put it to work on triage, enrichment, and response.

Your Impact

• Own detection engineering and threat hunting in CrowdStrike Next-Gen SIEM: onboard log sources, write and tune detections across identity, email, SaaS, and endpoint telemetry, and keep false positives down
• Own security automation: chain our tools together through CrowdStrike Fusion SOAR and our workflow automation platform so a signal in one (a risky Okta sign-in, a Falcon detection, a Mimecast hit, a Google Workspace sharing change) triggers enrichment, containment, paging, and ticketing in the others, plus AI agents that speed up triage and investigation, so routine response runs without waiting on a human
• Lead corporate incident response as technical lead, including third-party and supply-chain events: scope exposure quickly, confirm or rule out compromise, run forensics, tell leaders and employees what to do, keep runbooks current with Product Security, and serve in the escalation rotation, backing up the Incident Commander when needed
• Own CrowdStrike Falcon configuration and detections, manage the Falcon Complete relationship and escalations, and maintain device trust checks and an inventory of software and extensions on company devices with clear guidance on approved tools
• Own Okta authentication policy, MFA, session policy, and privileged access management, and automate user access reviews and audit evidence with Compliance so SOC 2 controls run with less manual effort
• Own Mimecast policy, secure network access, Google Workspace and key SaaS security settings, and SaaS security posture in CrowdStrike Falcon Shield, driving findings to closure with app owners
• Own data loss prevention: define and classify Fleetio's sensitive data, design and tune DLP policies across email (Mimecast), Google Workspace, endpoints (CrowdStrike), and key SaaS apps, and investigate and respond to data exposure, whether from accidental oversharing, a compromised account, or insider misuse
• Own security for Fleetio's use of AI: visibility into AI tool usage, identity and access for AI agents, guardrails for internal agents and automations, and AI detection and