Security Operations Engineer — SIEM & SOAR Automation

Alpaca; Brazil (IN); Remote; USD 110,000 - 180,000; Full time

Benefits offered by this job

Competitive Salary & Stock Options

New Hire Home-Office Setup: USD 500

Monthly Stipend: USD 150

Job summary

Alpaca is seeking a Security Operations Engineer to own daily operation and ongoing improvement of SIEM and SOAR capabilities. You will onboard logs, tune detections, keep alerts actionable, and automate response actions at scale.

This role partners with Security, IT, DevOps, and Engineering in a fully remote, distributed team. You will build dashboards, support incidents, and develop runbooks while focusing on operational excellence and cross-functional coordination.

Qualifications

• 3+ years of experience in Security Operations or detection engineering roles.
• Hands-on experience operating and tuning a SIEM.
• Experience building SOAR playbooks or equivalent response automation.
• Scripting or automation experience (Python, Bash) for security operations tasks.
• Experience onboarding and parsing log sources from cloud, identity, and SaaS platforms.
• Strong alert investigation skills across identity, endpoint, network, and cloud environments.
• Willing to participate in an on-call rotation.
• Strong written and verbal communication skills, especially during incidents.

Responsibilities

• Onboard security logs across cloud, identity, endpoint, SaaS, and apps.
• Develop and tune detections mapped to MITRE ATT&CK; ensure actionable alerts.
• Maintain dashboards for alert volume, ingest health, and response status.
• Support incidents with evidence collection, queries, and containment actions.
• Develop and improve runbooks and escalation paths for alerts and incidents.
• Track security metrics like MTTD and MTTR; participate in on-call rotations.

Skills

Security Operations

Detection engineering

SIEM tuning

Python scripting

Linux

Tools

SIEM

SOAR

GitOps

Job description

Alpaca is seeking a Security Operations Engineer to own daily operation and ongoing improvement of SIEM and SOAR capabilities. You will onboard logs, tune detections, keep alerts actionable, and automate response actions at scale.

This role partners with Security, IT, DevOps, and Engineering in a fully remote, distributed team. You will build dashboards, support incidents, and develop runbooks while focusing on operational excellence and cross-functional coordination.