AI-Driven Security Operations Engineer (Hybrid NY/SF)

Wwshemi; New York, San Francisco (NY, CA); Hybrid; USD 160,000 - 180,000; Full time

Benefits offered by this job

Equity

Bonus

Job summary

Alchemy is seeking a Security Operations Engineer to enhance threat detection, incident response, and security risk reduction across cloud, identity, endpoints, and production systems. This is a hands-on IC role emphasizing AI-assisted tooling, rigorous evidence handling, and measurable improvements to detection coverage and response reliability.

You will build detections, tune telemetry, maintain log pipelines, participate in on-call rotations, and collaborate with infrastructure and IT to

Qualifications

• Hands-on security operations experience spanning detection engineering, threat hunting, and incident response.
• Strong scripting and software-building ability, especially Python; experience with APIs, version control, tests, and operating automation in production.
• Experience with a SIEM such as Panther, Splunk, or an equivalent platform, including detection logic and log analysis.
• Working knowledge of cloud security, identity, endpoint telemetry, networking, and Linux systems. Ability to investigate across system boundaries.
• Evidence of building and using AI-assisted tools in security or adjacent engineering work.
• Sound incident judgment: you can separate a hypothesis from a finding, preserve evidence, and choose when to escalation or contain.
• A record of making teammates more effective through tools, mentoring, code review, or documentation, without needing management authority.
• Clear written communication and the willingness to own both urgent investigations and the follow-through that prevents repeat incidents.

Responsibilities

• Detect and investigate threats. Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments.
• Engineer detection coverage. Build and tune detections, onboard useful telemetry, and maintain reliable log pipelines.
• Respond to incidents. Participate in the security on-call rotation and incident response, including scoping, containment, recovery, and post-incident improvements.
• Build AI-assisted security workflows. Automate evidence collection, alert enrichment, investigation timelines, and response preparation.
• Verify before trusting. Evaluate AI-assisted workflows against known cases and adversarial inputs. Require evidence for conclusions, test false-positive and missed-threat behavior, and keep human approval for disruptive containment actions.
• Reduce operational exposure. Partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls, and attack-surface monitoring.
• Help secure agent operations. Work with platform and product-security partners on operational controls for agent identities, credentials, tool access, and audit logging.
• Improve how the team works. Share reusable code, investigation skills, runbooks, and evaluation cases. Pair with teammates, review automation, and teach approaches they can apply to their own investigations.
• Measure defensive outcomes. Track detection coverage, alert quality, investigation effort, response time, and remediation progress.

Skills

Python scripting

Threat hunting

Incident response

Security tooling

Documentation

Tools

Panther

Splunk

Job description

Alchemy is seeking a Security Operations Engineer to enhance threat detection, incident response, and security risk reduction across cloud, identity, endpoints, and production systems. This is a hands-on IC role emphasizing AI-assisted tooling, rigorous evidence handling, and measurable improvements to detection coverage and response reliability.

You will build detections, tune telemetry, maintain log pipelines, participate in on-call rotations, and collaborate with infrastructure and IT to