Member of Technical Staff, SecOps & Threat Detection (Staff/Principal Engineer)

Envoy; San Francisco (CA); In loco; USD 180.000 - 260.000; Tempo pieno

Descrizione del lavoro

Envoy is seeking a Staff Security Engineer to build and scale our Threat Detection and Security Operations. This hands-on role focuses on writing code, creating detection systems, and automating threat detection and response across infrastructure, applications, and endpoints.

You will lead the design and rollout of automated controls, integrate telemetry, and mentor engineers to raise the team’s detection capabilities—while collaborating with multiple orgs to improve overall security posture.

Competenze

• 10+ years in Security Engineering, SRE, or Infrastructure with a security focus.
• Strong programming or scripting skills (Python, Go) with automation experience.
• Hands-on with detection as code (DaC) including testing and deployment workflows.
• Proven track record building or improving security monitoring, SIEM, and analytics.
• Experience with cloud environments (AWS) and IAM, networking, logging.

Mansioni

• Design and evolve threat detection and security operations from the ground up.
• Write detection logic and maintain detection tests, version control, and deployment workflows.
• Build automation and integrations connecting telemetry, detections, and response workflows.
• Define detection strategy across cloud, apps, and endpoints.
• Improve SIEM architecture, signal quality, coverage, and scalability.
• Lead investigations and drive root-cause analysis and response.
• Define alerting models, severity, escalation, and on-call practices.
• Mentor engineers to raise capability in detection engineering and security operations.

Conoscenze

Python

Go

Detection as Code (DaC)

Automation

SIEM

Cloud security

Threat detection

Mentoring

Formazione

Bachelor's degree in CS or related field

Strumenti

SentinelOne

Descrizione del lavoro

Envoy protects the places the world relies on most by unifying people, spaces, and communications in one secure, integrated workplace management platform and ecosystem. More than 16,000 workplaces around the world trust Envoy to run secure, compliant, and connected operations across every location.

From manufacturing sites and data centers to life sciences labs, healthcare facilities, and corporate headquarters, Envoy unifies visitor management, risk assessment, mailroom management, digital signage software, resource booking, and emergency management into one integrated platform.

With deep integrations across access control, identity, compliance screening, and collaboration tools—including LenelS2, Brivo, Genetec, Honeywell, Cisco Meraki, Okta, Microsoft Azure, Microsoft Teams, Slack, ServiceNow, DocuSign, Avigilon Alta, and Descartes Visual Compliance—Envoy helps organizations reduce risk, stay audit-ready, and operate with clarity at scale.

This is an L5 opportunity. Successful candidates typically come from staff or principal-level roles and are recognized for establishing technical direction, leading large-scale initiatives, and shaping engineering strategy across organizations.

About the Role: We are building a proactive security function grounded in engineering, detection as code (DaC), and automation.

We are looking for a Staff Security Engineer to build and evolve our Threat Detection and Security Operations capabilities from the ground up. This is a hands-on engineering role focused on writing code, building detection systems, and automating threat detection and response across our infrastructure, applications, and endpoints.

Today, much of our security posture is reactive. This role will lead the shift toward reliable, measurable detection, with detection logic built, tested, version-controlled, reviewed, and deployed through an engineering workflow.

You will work across Infrastructure, Platform, and Workplace teams to ensure we have full visibility into our environment and can confidently answer: “If we had a security incident, how quickly would we know?”

This onsite position requires 4 days a week (Monday through Thursday) in our San Francisco HQ office.

You will

• Design and implement detection as code (DaC) practices, writing detection logic and setting standards for how it is tested, version controlled, reviewed, deployed, and maintained
• Own the design and evolution of our threat detection and security operations capabilities, building the foundations where little exists today
• Build automation and integrations that connect security telemetry, detections, and response workflows
• Define detection strategy across cloud infrastructure, applications, and endpoints
• Establish and improve our SIEM and monitoring architecture, including signal quality, coverage, and scalability
• Partner with engineering teams to improve instrumentation and ensure systems emit high quality security signals
• Drive visibility across all critical assets, ensuring endpoints, services, and identities are consistently monitored
• Take ownership of endpoint security monitoring (e.g., SentinelOne), including integration into centralized detection workflows
• Lead the design and rollout of automated security controls, including secrets rotation for high risk systems
• Define alerting strategy, including severity models, escalation paths, and on-call expectations
• Lead investigations into complex or ambiguous security signals, setting the standard for root cause analysis and response
• Define and track key metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), and drive measurable improvements
• Mentor and guide other engineers, raising the overall capability of the team in detection engineering and security operations

You have

• 10+ years of experience in Security Engineering, SRE, or Infrastructure Engineering with a strong security focus
• Strong programming or scripting skills (Python, Go, or similar), with experience building automation, integrations, and reliable systems
• Hands-on experience implementing detection as code (DaC), including testing, version control, code review, and deployment workflows
• Proven experience building or significantly improving security monitoring, detection, or SIEM systems
• Ability to operate in ambiguous environments and build systems and processes from the ground up
• Deep experience working with logs, events, and telemetry to build meaningful detections with strong signal quality
• Strong understanding of cloud environments (ideally AWS), including IAM, networking, and logging at scale
• A strong understanding of attacker behavior and the ability to translate threats into detection logic and strategies
• Experience defining alerting models and reducing noise while maintaining strong coverage
• Experience working with endpoint detection and response tools such as SentinelOne or similar
• Strong cross-functional communication skills, with the ability to influence engineering and leadership
• A pragmatic mindset focused on reducing real risk and improving operational effectiveness

By applying for this position, you acknowledge that you have fully read and understand the job requirements and received the Envoy Privacy Notice for applicants, which is linked here. Completing this application requires you to provide personal data, such as your name and contact information, which is mandatory for Envoy to process your application. Envoy is an EEO Employer and does not discriminate on the basis of any characteristic protected by local, state or federal law.