Forward Deployed Engineer, Security

Zaun; San Francisco (CA); On-site; USD 120,000 - 180,000; Full time

Job summary

Zaun is seeking a security operator embedded with our most important customers. You will deploy Zaun into their environment, write detections tailored to their threat model, and respond to real incidents alongside their team.

You will be the loop that closes between the customer and the product, turning field insight into product priorities and prototypes to improve the platform. This role thrives on shipping impactful tooling and working closely with client teams.

Qualifications

• 3+ years in detection engineering, SOC, incident response, or threat hunting.
• Strong scripting in Python or Go and comfortable in a real terminal.
• Calm under pressure; able to work with customers at their worst moments.
• Wants to ship, not write reports.

Responsibilities

• Deploy and onboard new customers from kickoff to first detection.
• Write detections and playbooks tuned to each customer environment.
• Respond to live incidents with the customer security team.
• Turn field insight into product priorities and prototypes.

Skills

Detection engineering

Python

Go

Incident response

Job description

About The Role

You will be the security operator embedded with our most important customers. Deploying Zaun into their environment, writing detections that fire on their real threat model, and responding to real incidents alongside their team.

You will be the loop that closes between the customer and the product. The things you cannot do in Zaun today become product priorities next week.

What you'll do

• Deploy and onboard new customers from kickoff to first detection
• Write detections and playbooks tuned to each customer environment
• Respond to live incidents with the customer security team
• Turn field insight into product priorities and prototypes

Who you are

• Three or more years in detection engineering, SOC, incident response, or threat hunting
• Strong scripting in Python or Go, comfortable in a real terminal
• Calm under pressure. Customers will see you in their worst moments
• Want to ship, not write reports

Nice to have

• Experience with cloud security (AWS, GCP, Azure) at scale
• Past work at an MSSP, MDR, or in-house SOC
• Detection content portfolio (Sigma, KQL, Splunk, custom)