Principal Security Operations Engineer

Digital Turbine Media, Inc.; Austin (TX); On-site; USD 130,000 - 180,000; Full time

Benefits offered by this job

Bonus plan

Equity plan

401(k)

Unlimited PTO

Job summary

Digital Turbine Media, Inc. is seeking a Principal Engineer of Security Operations to lead technical advancements in their Security Operations Center (SOC). This full-time hybrid role focuses on cloud security, incident response, and collaboration across teams to maintain robust monitoring capabilities.

The ideal candidate will have over 12 years of cybersecurity experience, particularly in SOC functions for GCP and AWS. This role offers a comprehensive benefits package including a bonus plan and unlimited PTO.

Qualifications

• 12+ years of cybersecurity experience with deep expertise in security operations.
• Significant hands-on experience developing and managing SOC functions for GCP and AWS.
• Strong familiarity with MSSP models and service quality measures.

Responsibilities

• Serve as the primary technical authority for Digital Turbine’s SOC ecosystem.
• Lead and execute complex incident investigations across GCP and AWS.
• Develop, test, and enhance incident response playbooks.

Skills

Cybersecurity experience

Security operations expertise

Incident response skills

Analytical skills

Communication skills

Education

Advanced security certifications (CISSP, GCIH, etc.)

Google Cloud certifications

Tools

CrowdStrike

Orca Security

SIEM/SOAR platforms

Job description

Position Overview

Digital Turbine is seeking a Principal Engineer of Security Operations to drive the evolution of our global Security Operations Center (SOC). This hybrid full‑time role focuses on technical leadership, operational excellence, and partnership with internal and external teams to ensure resilient 24x7 monitoring and response capabilities. Only candidates local to the posting location will be considered.

Responsibilities

• Serve as the primary technical authority for Digital Turbine’s SOC ecosystem and cloud threat detection strategy.
• Optimize and mature our relationship with a Managed Security Services Provider (MSSP), ensuring detection quality, response speed, and continuous tuning meet DT’s requirements.
• Lead and execute complex incident investigations, encompassing triage, analysis, containment, and remediation across GCP, AWS, and containerized workloads (Kubernetes, serverless, etc.).
• Design and maintain advanced detection and automation use cases using SIEM, SOAR, and log management platforms, tailored to DT’s cloud environments.
• Operationalize and fine‑tune tools such as CrowdStrike, Orca Security, and related platforms to maximize visibility and protection coverage.
• Develop, test, and enhance incident response playbooks and threat‑hunting methodologies aligned with MITRE ATT&CK and industry best practices.
• Plan, coordinate, and execute tabletop exercises, as well as business continuity (BC) and disaster recovery (DR) drills, to validate response readiness and cross‑team coordination.
• Define and track SOC performance metrics (e.g., MTTD, MTTR), producing clear and actionable insights for leadership and technical stakeholders.
• Collaborate with DevOps, application engineering, GRC, and legal teams to embed operational security practices that support compliance and business goals.
• Contribute to vendor selection, tooling evaluation, and threat intelligence initiatives that strengthen DT’s overall security posture.
• Act as a mentor and thought leader for peers and cross‑functional partners on detection engineering, incident response, and cloud security best practices.

Qualifications

• 12+ years of cybersecurity experience with deep expertise in security operations, threat detection, or incident response within global enterprise or SaaS environments.
• Significant hands‑on experience developing and managing SOC functions for GCP and AWS, including cloud logging, monitoring, and automation.
• Strong familiarity with MSSP models and understanding how to measure and improve service quality through engineering insight and data.
• Proficiency with SOC tooling such as CrowdStrike, Orca, SIEM/SOAR platforms, and related telemetry and automation tools.
• Deep understanding of modern adversary tradecraft, cloud attack paths, and detection engineering frameworks.
• Experience supporting or interfacing with compliance programs such as SOC2, ISO27001, or SOX.
• Excellent analytical and communication skills, with the ability to present technical findings and risks to both engineers and executives.
• Advanced security certifications such as CISSP, GCIH, GCFA, CISM, or CCFR are highly desirable.
• Google Cloud certifications (e.g., Professional Cloud Security Engineer, Professional Cloud Architect) preferred.
• Experience in cloud security operations across multi‑cloud environments (GCP and AWS).

Benefits

This full‑time role comes with a bonus plan, equity plan, 401(k), and unlimited PTO.

EEO Statement

Digital Turbine is an equal opportunity employer committed to exemplifying diversity and inclusion around the world. We welcome people of different backgrounds, experiences, abilities, and perspectives.