Security Engineer

five9; United States; Hybrid; USD 66,000 - 175,000; Full time

Job summary

five9 seeks a security engineer to build and operate the engineering systems behind an AI-enriched security triage process. The role centers on incident response, detection engineering, automation, threat intelligence, hunting, and reliable AI tooling.

You will own security incidents end to end, create, tune, detections, build automation, and translate threat intel into concrete hardening actions. This is a hybrid/remote US role with Pacific Time hours.

Qualifications

• Hands-on security operations experience with incident explanations.
• Proficiency in Python or a scripting language to automate recurring problems.
• Knowledge of detections, log pipelines, and telemetry from endpoint, identity, cloud, network, and SaaS sources.
• Ability to define success for ambiguous security problems and build practical solutions.
• Clear written communication for incident timelines, design documentation, and postmortems.
• Self-direction with limited day-to-day supervision.

Responsibilities

• Own security incidents through scoping, containment, forensic investigation, documentation, remediation, and follow-through.
• Create, tune, test, version, measure, and retire detections based on operational outcomes rather than alert volume.
• Build playbooks, integrations, and automated workflows that reduce repetitive response work.
• Track relevant threat activity and turn intelligence into detections, hunting hypotheses, and hardening actions.
• Contribute to hypothesis-driven threat hunting and improve the agents, prompts, and enrichment logic used by the triage pipeline.
• Handle escalations surfaced by the pipeline and feed investigation results back into the system to improve it.

Skills

Security operations

Python scripting

Incident response

Detections & telemetry

Cloud/AWS/GCP knowledge

Automation tooling (Tines / n8n)

Tools

Tines

n8n

Job description

Role overview

Build and operate the engineering systems behind an AI-enriched security triage process. The role is centered on incident response, detection engineering, response automation, threat intelligence, hunting, and the development of reliable AI tooling—not routine alert handling. You will be given security problems to solve end to end and will need to define the outcome, implement the solution, and communicate the reasoning clearly.

Responsibilities

• Own security incidents through scoping, containment, forensic investigation, documentation, remediation, and follow-through.
• Create, tune, test, version, measure, and retire detections based on operational outcomes rather than alert volume.
• Build playbooks, integrations, and automated workflows that reduce repetitive response work.
• Track relevant threat activity and turn intelligence into detections, hunting hypotheses, and hardening actions.
• Contribute to hypothesis-driven threat hunting and improve the agents, prompts, and enrichment logic used by the triage pipeline.
• Handle escalations surfaced by the pipeline and feed investigation results back into the system to improve it.

Requirements

• Hands-on security operations experience, including the ability to explain incidents in detail.
• Proficiency in Python or another scripting language, with a preference for solving recurring operational problems through code.
• Working knowledge of detection logic, log pipelines, and telemetry from endpoint, identity, cloud, network, and SaaS sources.
• Ability to take an ambiguous security problem, define what success means, and build a practical solution.
• Clear written communication for incident timelines, design documentation, and postmortems.
• Self-direction, sound judgment, and comfort working with limited day-to-day supervision.

Nice to have

• GCP or AWS experience, including cloud logging, IAM, and cloud-specific failure modes.
• Experience with Tines, n8n, or similar automation tools, including judgment about when to productionize a workflow in code.
• Agent development, prompt engineering, or experience operating AI-assisted detection and triage systems.

Benefits and work setup

• Requires working Pacific Time hours, from 9:00 a.m. to 5:00 p.m.
• Fully remote outside a 30-mile radius of an office; within that radius, the role is hybrid with three office days per week.
• The source lists a United States base salary range of $66,300–$174,700, plus potential bonus, equity, and benefits subject to applicable plans.