Founding U.S. Security Engineer — Cloud MDR

Upwind Security, Inc.; San Francisco, Northern (CA, KY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Upwind Security, Inc. is seeking a Security Engineer to join our MDR team as the founding U.S. member of the Security organization. The role focuses on proactive reviews, advanced customer guidance, and owning U.S.-hours coverage.

You will work with analysts, researchers, and engineers to scale the U.S. presence, improve detection and response, and develop playbooks for complex incidents, staying current with cloud threats and best practices.

Responsibilities

• Assist in fine-tuning Upwind's detection and response mechanisms.
• Support proactive reviews of customer environments to identify risks, exposed attack surfaces, and improvements.
• Lead and conduct in-depth security investigations — including supply chain, API, malware, and runtime attack scenarios — documenting outcomes and developing playbooks to enhance future detection and response.
• Collaborate with Security Analysts, Research, and Backend teams to enhance detection quality.
• Own the handling of complex or critical incidents escalated from Tier 1/2, including live, high-pressure engagements with customers.
• Participate in recurring customer meetings, helping translate security findings into clear, actionable recommendations — and maintain composure when conversations get tense.
• Stay up to date with emerging threats, attack techniques, attack surfaces, and best practices in cloud security.
• Contribute to the development and training of AI-driven detection models, leveraging machine learning to improve investigation accuracy and response efficiency.

Job description

Upwind Security, Inc. is seeking a Security Engineer to join our MDR team as the founding U.S. member of the Security organization. The role focuses on proactive reviews, advanced customer guidance, and owning U.S.-hours coverage.

You will work with analysts, researchers, and engineers to scale the U.S. presence, improve detection and response, and develop playbooks for complex incidents, staying current with cloud threats and best practices.