Security Analytics Engineer

Backblaze; United States; Remote; USD 140,000 - 210,000; Full time

Job summary

Backblaze seeks a security data and analytics lead to build and operate capabilities that help security teams detect, investigate, and respond to threats. The role spans telemetry pipelines, detection engineering, and observability, including monitoring AI agents and automated workflows.

You will design and maintain scalable platforms for security telemetry, normalizing and correlating data from endpoint, identity, cloud, app, infra, and network—develop detections, dashboards, and alerting

Qualifications

• Experience engineering SIEM, security analytics, detection, observability, or large-scale telemetry systems.
• Strong knowledge of logging, event correlation, data normalization and enrichment, and security pipelines.
• Experience creating detections, behavioral analytics, or correlation logic.
• Experience integrating security data from varied enterprise or cloud environments.
• Scripting or software development skills, including familiarity with APIs and infrastructure as code.
• Understanding of modern cloud and distributed systems.

Responsibilities

• Design and maintain scalable platforms and pipelines for security telemetry.
• Bring together data from endpoint, identity, cloud, application, infrastructure, network, and AI-enabled systems; normalize, enrich, and correlate it.
• Create and refine behavioral detections, correlation logic, dashboards, and alerting strategies.
• Turn threat intelligence, incidents, vulnerability findings, and offensive security results into better detection content.
• Develop observability for autonomous systems, tracking identities, tool use, execution, and other security-relevant activity.
• Use AI-assisted methods for log analysis, anomaly detection, enrichment, and investigation support while keeping workflows explainable and appropriately supervised.
• Improve the reliability, data quality, performance, retention, and cost of analytics platforms and related systems.

Skills

SIEM experience

Security analytics

Detection engineering

Observability

Telemetry systems

Data normalization

Correlation logic

Scripting skills

APIs familiarity

Infrastructure as code

Tools

APIs

Cloud platforms

Logging tools

Data pipelines

Job description

Role overview

Build and operate the data and analytics capabilities that help security teams detect, investigate, and respond to threats. The role spans security telemetry pipelines, detection engineering, and observability, including monitoring the behavior of AI agents and automated workflows.

Responsibilities

• Design and maintain scalable platforms and pipelines for security telemetry.
• Bring together data from endpoint, identity, cloud, application, infrastructure, network, and AI-enabled systems; normalize, enrich, and correlate it.
• Create and refine behavioral detections, correlation logic, dashboards, and alerting strategies.
• Turn threat intelligence, incidents, vulnerability findings, and offensive security results into better detection content.
• Develop observability for autonomous systems, tracking identities, tool use, execution, and other security-relevant activity.
• Use AI-assisted methods for log analysis, anomaly detection, enrichment, and investigation support while keeping workflows explainable and appropriately supervised.
• Improve the reliability, data quality, performance, retention, and cost of analytics platforms and related systems.

Requirements

• Experience engineering SIEM, security analytics, detection, observability, or large-scale telemetry systems.
• Strong knowledge of logging, event correlation, data normalization and enrichment, and security pipelines.
• Experience creating detections, behavioral analytics, or correlation logic.
• Experience integrating security data from varied enterprise or cloud environments.
• Scripting or software development skills, including familiarity with APIs and infrastructure as code.
• Understanding of modern cloud and distributed systems.

Nice to have

• Familiarity with security telemetry standards, MITRE ATT&CK, AI-assisted analytics, or observability for AI agents and autonomous systems.