Cloud SIEM Automation Engineer — Datadog & AI

Beyond Finance; Chicago, Northern (IL, KY); Hybrid; USD 100,000 - 120,000; Full time

Benefits offered by this job

Health, dental, and vision benefits

PTO and holidays

Parental leave

401(k) matching

Job summary

Beyond Finance is seeking a skilled security engineer to build detections and automation for cloud SIEM, SaaS apps, and endpoints. You will own Datadog Cloud SIEM detections, log pipelines, and automation workflows, while aligning coverage with MITRE ATT&CK and reducing noise and costs.

You will automate alert triage, support investigations, and contribute to AI-driven triage enhancements. A hands-on, production-ready mindset with IaC/CI/CD is required.

Qualifications

• 3+ years in security operations, detection engineering, or security engineering.
• Proficient in writing scripts and detection logic as code; IaC and CI/CD experience is a plus.
• Hands-on Datadog experience with Cloud SIEM detections and log pipelines.
• Experience with automation orchestration tooling.
• Familiarity with MITRE ATT&CK.
• Experience with security telemetry from cloud platforms, SaaS apps, and EDR.

Responsibilities

• Detection engineering: write, tune, and retire Cloud SIEM detections and map coverage to MITRE ATT&CK.
• Logging pipeline: onboard sources and build Datadog log pipelines that parse, normalize, and enrich telemetry.
• Detection-as-code: manage detections in version control with testing and peer review.
• Automation: build workflows for alert enrichment, triage, containment, and notification.
• AI in the SOC: build AI-assisted triage and alert summarization, with a human in the loop.
• Measure coverage, false positives, and automation rates to guide fixes.
• Manage indexes, exclusion filters, and retention tiers to balance cost and coverage.

Skills

Security operations

Detection engineering

Datadog

CI/CD

Automation tooling

MITRE ATT&CK

Threat hunting

Tools

Datadog Cloud SIEM

Log pipelines

Job description

Beyond Finance is seeking a skilled security engineer to build detections and automation for cloud SIEM, SaaS apps, and endpoints. You will own Datadog Cloud SIEM detections, log pipelines, and automation workflows, while aligning coverage with MITRE ATT&CK and reducing noise and costs.

You will automate alert triage, support investigations, and contribute to AI-driven triage enhancements. A hands-on, production-ready mindset with IaC/CI/CD is required.