Senior Security Engineer

Guardant Health, Inc.; Palo Alto (CA); Hybrid; USD 130,300 - 179,200; Full time

Job summary

Guardant Health, Inc. in Palo Alto, CA is looking for a Senior Security Engineer to enhance security logging, detection, and response capabilities. You will design and maintain security data pipelines and serve as a SIEM subject matter expert.

The ideal candidate has over 5 years of experience in security engineering, with expertise in AWS security and incident response. This role allows for a hybrid work model with onsite requirements three days a week.

Qualifications

• 5+ years of experience in security engineering, security operations, or detection engineering.
• Strong experience migrating or modernizing SIEM and logging architectures.
• Deep hands-on experience with SIEM platforms.

Responsibilities

• Design, build, and operate scalable security logging and data pipelines.
• Develop and maintain high-fidelity threat detection content.
• Support and participate in incident response, including investigation and containment.

Skills

Security engineering

Detection engineering

Incident response

SIEM

AWS security

Communication skills

Education

5+ years of experience

Tools

CrowdStrike

Okta

Job description

Position Summary

The Senior Security Engineer reports to the Associate Director of Security Engineering and will design, build, and operate Guardant Health’s security logging, detection, and response capabilities, focusing on security data engineering, SIEM architecture, detection engineering, and incident response with emphasis on cloud and endpoint visibility.

Essential Duties and Responsibilities

• Design, build, and operate scalable security logging and data pipelines for on-prem, cloud, endpoint, identity, and SaaS platforms.
• Serve as the SIEM subject matter expert, including architecture, onboarding of new log sources, data normalization, performance tuning, cost optimization, and regulatory compliance.
• Develop and maintain high‑fidelity threat detection content, including rules, analytics, and behavioral detections across endpoint, cloud, and identity data.
• Own and enhance detection engineering workflows, including testing, tuning, false‑positive reduction, and coverage analysis.
• Manage and optimize EDR tooling (e.g., CrowdStrike), including telemetry ingestion, detections, response actions, and integrations with the SIEM.
• Support and participate in incident response, including investigation, containment, eradication, and post‑incident review.
• Build dashboards, metrics, and reports to measure detection coverage, SOC effectiveness, and security posture.
• Monitor and help secure AWS and cloud‑native environments, including CloudTrail, VPC Flow Logs, workload logs, and SaaS integrations.
• Evaluate and implement AI‑assisted security capabilities for defense and detection, while defining how AI systems, agents, and usage are logged, monitored, and assessed for risk.
• Develop documentation, runbooks, and operational playbooks for SOC and security engineering workflows.
• Partner closely with IT, cloud, infrastructure, threat & vulnerability, and security architecture teams.
• Mentor junior engineers and provide technical leadership within the SOC and security engineering functions.
• Stay current on emerging threats, detection techniques, attacker tradecraft, and security data engineering best practices.

Required Qualifications

• 5+ years of experience in security engineering, security operations, or detection engineering.
• Deep hands‑on experience with SIEM platforms, including building detections and managing large‑scale log ingestion.
• Strong experience migrating or modernizing SIEM and logging architectures.
• Proven experience with EDR platforms, preferably CrowdStrike.
• Led SIEM migrations, including planning, data model mapping, detection parity, and validation.
• Strong background in threat detection and incident response within an SOC environment.
• Experience designing and operating security logging pipelines at scale.
• Hands‑on experience securing AWS and cloud environments.
• Experience working with identity and access logs, including Okta.
• Understanding of AI and machine‑learning use cases in security, including detection, automation, and governance considerations.
• Strong written and verbal communication skills.
• Ability to work independently and collaboratively in a fast‑paced environment.

Preferred Qualifications

• Experience with detection engineering frameworks (e.g., MITRE ATT&CK).
• Experience building SOAR or response automation.
• Experience in healthcare, biotech, or other regulated environments.
• Security certifications such as CISSP, GIAC, GCED, GCIA, or cloud security certifications.

Hybrid Work Model

This role is eligible for hybrid work with onsite days required on Mondays, Tuesdays, and Thursdays for U.S. employees within 50miles of a Guardant facility.

Salary

• Primary Location: Palo Alto, CA – $130,300–$179,200
• Other U.S. Locations – $110,755–$152,320
• Colorado – $117,270–$161,280

Equal Opportunity Employer

Guardant Health is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or protected veteran status and will not be discriminated against on the basis of disability. All your information will be kept confidential according to EEO guidelines.