Cyber Defense Platforms Staff Engineer

Scorpion Therapeutics; Cambridge (MA); On-site; USD 170,000 - 230,000; Full time

Job summary

Scorpion Therapeutics is seeking a senior security engineering leader in Cambridge, MA to own deployment, configuration, and lifecycle of defense platforms including SIEM, SOAR, EDR, and DLP. You will define a platform roadmap, engineer data pipelines, and own the detection content lifecycle end-to-end, while advancing detection-as-code practices and integration across enterprise systems.

You will map coverage to MITRE ATT&CK, collaborate with threat intel/IR/offensive security, and design SOAR

Qualifications

• 8+ years in security engineering/operations with ownership of defense platforms.
• Hands-on expertise architecting SIEM/SOAR/EDR/DLP or email security.
• Strong automation software engineering with production integrations.
• Experience building/managing detection content at scale (MITRE ATT&CK).
• Proven automation-driven operational improvements.
• Ability to operate autonomously in a build-from-zero environment.
• Experience standing up or modernizing a security ops stack (SIEM/SOAR/EDR).
• Cloud security experience, especially AWS-native services.
• Experience in regulated industries (pharma/biotech/healthcare/financial services).
• Relevant certifications (GIAC GCDA/GDAT/GCIA, CISSP) or equivalent expertise.

Responsibilities

• Own deployment, configuration, administration, and lifecycle of defense platforms (SIEM, SOAR, EDR, DLP, email security, anti-phishing).
• Define the platform roadmap: evaluate, deploy, integrate, and rationalize security technologies.
• Engineer and maintain enterprise security data pipelines (log onboarding, normalization, enrichment, retention, cost management).
• Own the detection content lifecycle end-to-end (development, testing, tuning, versioning, retirement).
• Establish detection-as-code practices (version control, peer review, CI/CD, automated validation).
• Map detection coverage to MITRE ATT&CK; identify gaps and partner with threat intel/IR/OEA to create durable detections.
• Design and build SOAR playbooks and workflow automation to reduce manual effort and accelerate triage/response.

Skills

Security engineering

SIEM

SOAR

EDR

Automation

MITRE ATT&CK

Tools

Python

Go

PowerShell

Job description

Responsibilities:

• Own deployment, configuration, administration, and lifecycle of defense platforms including SIEM, SOAR, EDR, DLP, email security, and anti-phishing.
• Define the platform roadmap: evaluate, deploy, integrate, and rationalize security technologies.
• Engineer and maintain enterprise security data pipelines (log onboarding, normalization, enrichment, retention, cost management).
• Own the detection content lifecycle end-to-end (development, testing, tuning, versioning, retirement).
• Establish detection-as-code practices (version control, peer review, CI/CD, automated validation).
• Map detection coverage to MITRE ATT&CK; identify gaps and partner with threat intel/IR/offensive security to create durable detections.
• Design and build SOAR playbooks and workflow automation to reduce manual effort and accelerate triage/response (including automated handling of user-reported phishing).
• Build internal tooling, integrations, and APIs connecting security platforms to each other and enterprise systems.
• Set standards for building/deploying/operating the defense technology domain; serve as technical authority.
• Lead cross-functional technical initiatives and mentor engineers and analysts.

Qualifications:

• 8+ years in security engineering/operations/detection engineering with ownership of defense/security platforms.
• Hands-on expertise architecting/administering SIEM/SOAR/EDR/DLP or email security and anti-phishing.
• Strong security automation software engineering (e.g., Python, Go, PowerShell) with production integrations.
• Experience building/managing detection content at scale (e.g., MITRE ATT&CK).
• Proven automation-driven operational improvements.
• Ability to operate autonomously in a build-from-zero environment.
• Experience standing up or modernizing a security ops stack (e.g., SIEM migration, SOAR implementation, EDR rollout).
• Cloud security experience, especially AWS-native services.
• Experience in regulated industries (pharma/biotech/healthcare/financial services).
• Relevant certifications (e.g., GIAC GCDA/GDAT/GCIA, CISSP) or equivalent expertise.