Security Operations Engineer

Alpaca; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Stock Options

Health Benefits

New hire home-office setup

Job summary

Alpaca is a US-headquartered financial services infrastructure company offering brokerage APIs and trading platforms. This Security Operations Engineer role owns the daily operation and continuous improvement of Alpaca's SIEM and SOAR capabilities, including log onboarding, detection engineering, alert tuning, and response automation.

The role involves onboarding new log sources, building and tuning detection rules, and designing SOAR playbooks to automate responses.

Qualifications

• 3+ years in Security Operations or detection engineering.
• Hands-on SIEM operation and tuning.
• Experience building SOAR playbooks.
• Proficient in Python or Bash scripting.
• Experience onboarding log sources from cloud/identity/SaaS.
• Strong alert investigation across identities, endpoints, networks, and cloud.
• Familiar with attacker techniques and detection methodologies.
• Experience incident response and runbooks.

Responsibilities

• Onboard new security log sources across cloud, identity, endpoint, SaaS, and applications with parsing and data quality checks.
• Build, test, and tune detection rules mapped to MITRE ATT&CK.
• Design and maintain SOAR playbooks to automate response actions.
• Triage, investigate, and respond to security alerts across domains.
• Support security incidents with evidence collection and containment; improve runbooks.
• Run hypothesis-driven threat hunts and translate findings into new detections.
• Participate in Security Operations on-call rotation.

Skills

Security operations

Detection engineering

Incident response

Python

Bash

Linux

Alert investigations

Tools

SIEM

SOAR

GitOps

CI/CD pipelines

Kubernetes security tooling

Job description

Alpaca is a US-headquartered financial services infrastructure company offering brokerage APIs and trading platforms. This Security Operations Engineer role owns the daily operation and continuous improvement of Alpaca's SIEM and SOAR capabilities, including log onboarding, detection engineering, alert tuning, and response automation.

What You'll Do

• Onboard new security log sources across cloud, identity, endpoint, SaaS, and application systems with parsing, normalization, and data quality checks
• Build, test, and tune detection rules based on threat intelligence and incident learnings, mapped to frameworks such as MITRE ATT&CK
• Design and maintain SOAR playbooks that automate response actions including enrichment, containment, ticketing, and notifications
• Triage, investigate, and respond to security alerts across endpoints, identity, cloud, network, and application logs
• Support security incidents with evidence collection, detection queries, and containment actions; develop and improve runbooks and escalation paths
• Run hypothesis-driven threat hunts and turn findings into new detections
• Participate in the Security Operations on-call rotation

What You Need

• 3+ years of experience in Security Operations or detection engineering roles
• Hands-on experience operating and tuning a SIEM
• Experience building SOAR playbooks or equivalent response automation
• Working knowledge of Linux
• Scripting or automation experience in Python or Bash for security operations tasks
• Experience onboarding and parsing log sources from cloud, identity, and SaaS platforms
• Strong alert investigation skills across identity, endpoint, network, and cloud environments
• Understanding of common attacker techniques and detection methodologies
• Experience supporting security incidents, including evidence collection, detection queries, and containment
• Strong written and verbal communication skills, especially during incidents

Nice to Have

• Experience securing financial, trading, or other highly regulated platforms
• Familiarity with compliance frameworks such as SOC 2 or ISO 27001
• Experience with detection-as-code, GitOps, and CI/CD pipelines
• Knowledge of cloud security logging on AWS, GCP, or Azure and SaaS security telemetry
• Familiarity with Kubernetes-hosted security tooling
• Security certifications such as GCIA, GCIH, or GCED
• Ability to balance security rigor with operational efficiency and business needs

Competitive Salary & Stock Options, Health Benefits, New Hire Home-Office Setup: One-time USD $500, Monthly Stipend: USD $150/month via Brex Card