Security Operations Engineer

Holistiplan; United States; Remote; USD 110,000 - 170,000; Full time

Benefits offered by this job

Fully remote work environment

Competitive salary

Unlimited PTO

Health insurance (medical/dental/vison

401k with company match

Annual company onsite

All expenses paid travel

Job summary

Holistiplan is seeking a Security Engineer to own day‑to‑day security operations across cloud, detection, and audit readiness. You’ll work with the CISO to maintain SOC 2 Type II posture while expanding coverage of threat monitoring and incident response.

The role emphasizes hands‑on cloud security, vulnerability management, and AI‑assisted security tooling. Remote US work with cross‑functional collaboration across the security and engineering teams.

Qualifications

• 2–4 years in security operations, cloud security, or related role.
• Hands‑on with securing AWS environments (IAM, VPC, S3, CloudTrail).
• Experience with SIEM platforms; Datadog Security Monitoring is a plus.
• Incident response experience including triage and post‑incident analysis.
• Familiarity with vulnerability management, CVE triage, and remediation tracking.
• Understanding of governance, SOC 2, ISO 27001, NIST CSF or similar compliance frameworks.
• Familiarity with MITRE ATT&CK and secure development practices.

Responsibilities

• Build, tune, and maintain detection rules and dashboards in Datadog Security Monitoring.
• Triage security alerts, investigate incidents, and follow IR playbooks.
• Reduce alert fatigue through tuning and correlation logic.
• Contribute to log source coverage mapping to MITRE ATT&CK.
• Respond to endpoint alerts with EDR/XDR tools and contain incidents as needed.
• Support internal audits and compliance activities with evidence collection.

Skills

Security operations

Cloud security

AWS security

Incident response

Vulnerability management

Auditing/compliance

MITRE ATT&CK

Scripting basics

Tools

Datadog Security Monitoring

CrowdStrike Falcon

SentinelOne

Microsoft Defender XDR

SAST/DAST/Software composition analysis tools

AWS Systems Manager Patch Manager

Job description

Holistiplan offers award winning tax planning software specializing in tax planning, insurance risk management, and soon to be estate! We’re known for our industry leading tactical tax planning, reporting and scenario analysis solutions serving over 10,000 firms and 60,000 users. Holistiplan has been voted the #1 tax planning software in Kitces Report Studies and the #1 tax planning software for five consecutive years in the T3/Inside Information Software Surveys.

Learn more at www.holistiplan.com.

About the Role

Holistiplan builds the financial planning platform trusted by Registered Investment Advisors (RIAs) to serve their clients — which means we handle sensitive tax documents, PII, and financial records at scale. We're looking for a Security Engineer who can operate confidently across cloud infrastructure, detection engineering, and audit readiness to help us stay ahead of threats while maintaining our SOC 2 Type II posture.

This role is a strong fit for someone with solid hands‑on security experience who wants to keep building depth across cloud security, threat monitoring, incident response, vulnerability management, application security triage, and compliance support. You'll work closely with the CISO, taking ownership of day‑to‑day security operations with increasing independence, while escalating high‑impact decisions appropriately.

What You’ll Do

Holistiplan | Security Team

Location: Remote

Level: Mid

Reports to: CISO

Cloud Security (AWS)

• Monitor and assess AWS environments (IAM, VPC, S3, KMS, CloudTrail, GuardDuty, Security Hub) and drive remediation of misconfigurations or exposed resources
• Review infrastructure changes for security implications; partner with engineering on secure architecture patterns
• Investigate configuration drift and IAM privilege escalation risks, escalating high‑impact findings to the CISO
• Support patch management across AWS infrastructure (EC2 OS‑level patching, AMI/golden image currency, AWS Systems Manager Patch Manager), with CISO/CTO sign‑off on production‑impinging changes

Detection & Monitoring (SIEM & EDR/XDR)

• Build, tune, and maintain detection rules and dashboards in Datadog Security Monitoring
• Triage security alerts, perform investigation, and elevate confirmed incidents per the IR playbooks
• Reduce alert fatigue through signal tuning, correlation logic, and false‑positive analysis
• Contribute to log source coverage gap analysis (mapped to MITRE ATT&CK where applicable)
• Monitor and respond to endpoint alerts via EDR/XDR tooling; investigate suspicious process activity and isolate compromised hosts, escalating for containment decisions
• Correlate signal across endpoint, identity, network, and cloud telemetry within the XDR platform to identify multi‑stage attacks that single‑source alerting would miss
• Help maintain EDR/XDR agent health/coverage across the fleet and tune detection policies to reduce false positives
• Support onboarding of new telemetry sources into the XDR platform and help evaluate detection coverage against the MITRE ATT&CK framework

AI‑Enabled Security Operations

• Use AI tools to accelerate detection, triage, response, and documentation
• Evaluate and pilot AI‑assisted security tooling, with appropriate data handling safeguards
• Help build internal playbooks/prompts that make the security team faster without compromising data governance

Incident Response

• Serve as a responder during security incidents: triage, containment, eradication, and recovery per the IR plan
• Perform initial forensic analysis on affected hosts, cloud resources, and accounts (log review, timeline reconstruction, scope determination)
• Support post‑incident activities: root cause analysis, lessons‑learned documentation, and tracking of remediation actions to closure
• Participate in tabletop exercises to validate IR readiness and identify playbook gaps
• Support breach assessment activities in partnership with the CISO; final notification decisions rest with the CISO and legal/compliance

Vulnerability Management

• Own recurring vulnerability scanning across cloud infrastructure, endpoints, and application layers
• Triage and prioritize identified vulnerabilities and relevant CVEs by exploitability and business impact
• Track remediation against SLA targets; own patch execution for AWS infrastructure and partner with engineering on application‑layer and third‑party dependency fixes
• Maintain vulnerability management metrics and reporting for internal stakeholders and audit evidence
• Monitor threat intelligence feeds and vendor advisories for vulnerabilities relevant to Holistiplan's stack; lead with impact/action, not just background, when summarizing findings

Application Security

• Review and triage findings from existing SAST, DAST, and software composition analysis (SCA/dependency scanning) tools
• Prioritize identified vulnerabilities by exploitability and business impact and route to engineering for remediation
• Track remediation progress against SLA targets and maintain reporting for audit evidence

Governance & Access Management

• Support periodic access reviews and entitlement recertification (least‑privilege validation across AWS, SaaS tools, and internal systems)
• Assist in drafting and maintaining security policies, standards, and procedures; support annual policy review cycles
• Track and log policy exceptions per governance process
• Contribute security metrics and status updates for board/executive‑level reporting

Internal Audits & Compliance

• Support SOC 2 Type II control testing, evidence collection, and remediation tracking
• Conduct internal control walkthroughs and identify gaps against frameworks (SOC 2 CC series, NIST CSF, CIS Controls)
• Maintain and update risk register entries, control documentation, and audit evidence repositories
• Partner with engineering to close audit findings on schedule
• Support third‑party/vendor security risk assessments, including review and summarization of vendor security questionnaires
• Help map applicable regulatory requirements (e.g., GLBA, CCPA) to internal controls and flag gaps for CISO/legal review

What You Bring

Required

• 2–4 years of experience in security operations, cloud security, or a related analyst/engineer role
• Hands‑on experience securing and monitoring AWS environments (IAM, VPC, S3, CloudTrail, GuardDuty, SecurityHub)
• Experience with a SIEM platform; direct Datadog Security Monitoring experience is a plus
• Experience with Endpoint Detection and Response (EDR) and/or Extended Detection and Response (XDR) tools (e.g., CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR)
• Hands‑on incident response experience — triage, containment, and post‑incident root cause analysis
• Experience supporting a vulnerability management program, including scan tooling, CVE triage, and remediation tracking
• Familiarity with using AI/LLM tools for security workflows (triage, enrichment, documentation) with an understanding of associated data‑handling risks
• Experience supporting internal audits or compliance programs (SOC 2, ISO 27001, NIST CSF, or similar)
• Familiarity with GLBA, CCPA, or other financial data privacy regulations sufficient to help map requirements to controls
• Solid understanding of common attack techniques and the MITRE ATT&CK framework
• Working familiarity with SAST/DAST/SCA tool output — comfortable reading and triaging findings
• Clear written communication — you'll document findings for auditors, engineers, and leadership alike

Nice to Have

• Experience in fintech or regulated financial services environments
• Scripting ability (Python, Bash) for automation of detection or audit workflows
• A security certification such as Security+, GCIH, GCFA, or AWS Security Specialty

What We Offer

• Fully remote work environment
• Competitive salary
• Unlimited PTO
• Health insurance (medical/dental/vision)
• 401k with company match
• All expenses paid annual company onsite at a hotel and resort