Senior Detection & Security Operations Engineer (Remote)

Arkenstone; Menlo Park (CA); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

Health insurance

401(k) plan with matching

Paid time off and holidays

Employee assistance program

Professional development

Job summary

Arkenstone Defense is seeking a Staff Detection Security Operations Engineer (Remote, US) to lead threat monitoring, detection, and security data analytics across multi-clouds. You will own incident response, architecture decisions, and observability while guiding teams in a compliance-heavy, mission-critical environment.

You will design SIEM alerts, tune detections, and mentor engineers, with responsibilities spanning AWS/Azure/GCP, FedRAMP/NIST controls, and customer collaboration.

Qualifications

• 5-8 years of experience in Security Engineering and/or Detection engineering roles
• Hands-on exposure to AWS Athena
• Proficiency in detection engineering: alert creation and tuning - writing SQL, KQL, Sigma, or YARA rules for threat detection
• Proven track record of operating large-scale systems in multi-cloud environments
• Strong knowledge of cloud-native architecture, container orchestration (e.g., Kubernetes), and CI/CD pipelines
• Proficient in scripting (Python, Bash, etc.) and infrastructure automation tools
• Experience with monitoring/observability platforms (e.g., Prometheus, Grafana, Datadog, etc.)
• Excellent problem-solving skills and a bias toward ownership and action
• Familiarity with SIEM platforms
• Working knowledge of incident response processes, procedures, and documentation standards
• Comfortable making decisions under pressure and leading through incidents
• Working knowledge of FedRAMP or NIST 800-53 controls preferred
• Comfortable participating in customer discussions
• Clear communicator who can translate technical concepts to mixed audiences

Responsibilities

• Own incident management lifecycle from detection to postmortem and root cause analysis
• Monitor SIEM and security tools; perform triage and tune detections per playbooks
• Collect and correlate security data to distinguish true positives from noise
• Monitor threat intel sources and implement continuous monitoring for real-time awareness
• Participate in on-call rotation for after-hours security monitoring and incident response
• Design and review security architectures for FedRAMP/CMMC-aligned environments
• Lead security assessments and drive remediation across customer portfolio
• Develop automation and infrastructure-as-code patterns adopted across programs
• Drive observability improvements: metrics, alerting, dashboards
• Lead cross-functional initiatives spanning security, IT, compliance, and product teams
• Provide mentorship and code/design review across engineers
• Own infrastructure reliability strategy across AWS, Azure, and GCP

Skills

Security engineering

Detection engineering

Incident response

SQL

KQL

Sigma

YARA

Python

Bash

CI/CD

Cloud-native architecture

Ownership

Communication

Tools

AWS Athena

Kubernetes

Prometheus

Grafana

Datadog

SIEM

EDR

Job description

Arkenstone Defense is seeking a Staff Detection Security Operations Engineer (Remote, US) to lead threat monitoring, detection, and security data analytics across multi-clouds. You will own incident response, architecture decisions, and observability while guiding teams in a compliance-heavy, mission-critical environment.

You will design SIEM alerts, tune detections, and mentor engineers, with responsibilities spanning AWS/Azure/GCP, FedRAMP/NIST controls, and customer collaboration.