Security Operations Engineer: SIEM, SOAR & Threat Hunting

Alpaca; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Stock Options

Health Benefits

New hire home-office setup

Job summary

Alpaca is a US-headquartered financial services infrastructure company offering brokerage APIs and trading platforms. This Security Operations Engineer role owns the daily operation and continuous improvement of Alpaca's SIEM and SOAR capabilities, including log onboarding, detection engineering, alert tuning, and response automation.

The role involves onboarding new log sources, building and tuning detection rules, and designing SOAR playbooks to automate responses.

Qualifications

• 3+ years in Security Operations or detection engineering.
• Hands-on SIEM operation and tuning.
• Experience building SOAR playbooks.
• Proficient in Python or Bash scripting.
• Experience onboarding log sources from cloud/identity/SaaS.
• Strong alert investigation across identities, endpoints, networks, and cloud.
• Familiar with attacker techniques and detection methodologies.
• Experience incident response and runbooks.

Responsibilities

• Onboard new security log sources across cloud, identity, endpoint, SaaS, and applications with parsing and data quality checks.
• Build, test, and tune detection rules mapped to MITRE ATT&CK.
• Design and maintain SOAR playbooks to automate response actions.
• Triage, investigate, and respond to security alerts across domains.
• Support security incidents with evidence collection and containment; improve runbooks.
• Run hypothesis-driven threat hunts and translate findings into new detections.
• Participate in Security Operations on-call rotation.

Skills

Security operations

Detection engineering

Incident response

Python

Bash

Linux

Alert investigations

Tools

SIEM

SOAR

GitOps

CI/CD pipelines

Kubernetes security tooling

Job description

Alpaca is a US-headquartered financial services infrastructure company offering brokerage APIs and trading platforms. This Security Operations Engineer role owns the daily operation and continuous improvement of Alpaca's SIEM and SOAR capabilities, including log onboarding, detection engineering, alert tuning, and response automation.

The role involves onboarding new log sources, building and tuning detection rules, and designing SOAR playbooks to automate responses.