Security Operations Engineer - Incident Response & Detection

Socket.dev; Los Angeles (CA); Hybrid; USD 200,000 - 250,000; Full time

Benefits offered by this job

Accelerated Growth Environment

Top Tier Compensation Package

Flexible Time Off

Comprehensive Benefits Package

Job summary

StubHub is redefining the live event experience globally. We seek a Security Operations Engineer to drive incident response, threat detection, and SIEM enhancements at scale. You will write production-grade code, architect detection pipelines, and mature our SOC-less approach to Detection & Response.

Location: Hybrid (3 days in office/2 days remote) – New York, NY or Century City, CA. You will collaborate across Cloud Security, Identity Engineering, and cross-functional teams to strengthen

Qualifications

• 3+ years experience in security engineering or related field.
• Hands-on incident response leadership including complex investigations.
• Proficiency in Python or other programming languages for security problems.
• Deep familiarity with SIEM platforms and query languages.

Responsibilities

• Lead and coordinate end-to-end security incident response: detect, triage, contain, eradicate, recover, and review.
• Design, build, and tune detection rules and analytics across cloud, endpoint, network, and apps.
• Maintain threat models and map detections to MITRE ATT&CK.
• Develop and maintain security automation, tooling, and integration dashboards.
• Collaborate with red team and third-party security partners to validate coverage.

Skills

Python

Go

SIEM

Incident response

Threat detection

Cloud security

Communication

Education

Security certifications (GCIH, GCIA, GCFE, OSCP)

Tools

Splunk

ELK

Chronicle

Panther

SOAR

EDR

Job description

StubHub is redefining the live event experience globally. We seek a Security Operations Engineer to drive incident response, threat detection, and SIEM enhancements at scale. You will write production-grade code, architect detection pipelines, and mature our SOC-less approach to Detection & Response.

Location: Hybrid (3 days in office/2 days remote) – New York, NY or Century City, CA. You will collaborate across Cloud Security, Identity Engineering, and cross-functional teams to strengthen