Remote Staff Threat Detection Engineer - Cloud & SOC

Guardant Health, Inc.; United States; Remote; USD 134,000 - 184,000; Full time

Job summary

Guardant Health, Inc. is seeking a Staff Security Engineer to strengthen threat detection, incident response, and security automation across infrastructure, cloud, and identity platforms.

You will lead high‑fidelity detections, tune SIEM/EDR, and coordinate with external MDRs to improve investigations and response. The role emphasizes hands‑on engineering, scalable logging pipelines, AI‑assisted defense, and cross‑team collaboration within Security Operations and Security Engineering.

Qualifications

• 8+ years of experience in security engineering, security operations, detection engineering, or incident response.
• Strong hands-on experience developing, testing, and tuning SIEM and EDR detections across multiple environments.
• Experience owning open source threat intelligence platforms such as MISP, Yeti, and OpenCTI.
• Experience working with external MDR providers, managed SOCs, or SIEM service partners to improve detection content, investigations, escalations, and response outcomes.
• Strong incident response experience, including leading technical investigations and coordinating containment, eradication, and recovery activities.

Responsibilities

• Develop and maintain high-fidelity threat detection content, including rules, analytics, and behavioral detections across infrastructure, endpoint, cloud, SaaS and identity platforms.
• Own and enhance detection engineering workflows, including testing, tuning, false-positive reduction, and coverage analysis.
• Partner closely with external MDR provider to develop and refine detection rules, improve investigation quality, and establish effective escalation and response workflows.
• Support and participate in incident response, including investigation, containment, eradication, and post-incident reviews.
• Build dashboards, metrics, and reports to measure detection coverage, SOC effectiveness, and security posture.
• Monitor and help secure AWS and cloud-native environments, including CloudTrail, VPC Flow Logs, workload logs, and SaaS integrations.
• Evaluate and implement AI-assisted security capabilities for defense and detection, while also defining how AI systems, agents, and usage are logged, monitored, and assessed for risk.
• Develop documentation, runbooks, and operational playbooks for SOC and security engineering workflows.
• Mentor junior engineers and provide technical leadership within the SOC and security engineering functions.
• Stay current on emerging threats, detection techniques, attacker tradecraft, and security data engineering best practices.

Skills

Threat detection

Security engineering

Incident response

EDR detections

AWS security logs

Threat intelligence platforms

MDR collaboration

Security automation

Communication skills

Tools

SIEM

EDR

CloudTrail

VPC Flow Logs

OpenCTI

MISP

Yeti

Job description

Guardant Health, Inc. is seeking a Staff Security Engineer to strengthen threat detection, incident response, and security automation across infrastructure, cloud, and identity platforms.

You will lead high‑fidelity detections, tune SIEM/EDR, and coordinate with external MDRs to improve investigations and response. The role emphasizes hands‑on engineering, scalable logging pipelines, AI‑assisted defense, and cross‑team collaboration within Security Operations and Security Engineering.