Senior Security Engineer, Detection and Response

marqeta-inc; United States; Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Remote-first work model

Competitive base salary with annualbon

Equity in a publicly traded company

Job summary

Marqeta Inc. is seeking a senior security engineer to lead incident response for North American operations and to shape advanced detection and response practices.

The role blends hands-on investigation, detection engineering, and threat hunting with mentoring while leveraging AI-driven automation on a next-generation SOAR platform. You will serve as a lead technical responder during security events, participate in a 24x7 on-call rotation, and design detection coverage maps to improve logging,

Qualifications

• 5+ years of hands-on security operations experience with emphasis on incident response and detection engineering.
• Strong working knowledge of enterprise security tools such as EDR, NDR, CSPM, EASM, SIEM, SOAR, and cloud security platforms.
• Solid understanding of AWS cloud services and containerization technologies.
• Proficiency applying threat intelligence frameworks such as MITRE ATT&CK to assess coverage and gaps.
• Demonstrated ability to design new detection use cases from telemetry analysis, baselining, threat intel, and incident findings.
• Investigative mindset, intellectual curiosity, and commitment to staying current with emerging threats and adversary tactics.
• Industry certifications such as GCIH, GCFA, GIME, OSIR, or GEIR are strongly preferred.

Responsibilities

• Lead technical responder during security events in North American timezones, triaging alerts.
• Participate in 24x7 on-call rotation for incidents and investigations.
• Engineer and tune detection logic across data sources with threat modeling.
• Design detection coverage maps and inform logging and monitoring improvements.
• Build and maintain incident response runbooks, SOPs, and KPIs like MTTD/MTTR.
• Develop automation workflows and AI-driven tooling for detection and response.
• Conduct proactive threat hunts across corporate and production environments.
• Mentor junior team members on detection engineering and incident response.

Skills

Incident response

Detection engineering

Threat hunting

MITRE ATT&CK

AWS & containerization

SIEM & SOAR

Threat intel

On-call / mentoring

Tools

EDR

NDR

CSPM

EASM

SIEM

SOAR

Docker/Kubernetes

Job description

Role overview

A senior-level security engineering position on a Security Operations and Response team, focused on leading incident response for North American operations and shaping modern detection and response practices. The role blends hands-on investigation, detection engineering, and threat hunting with mentoring, while leveraging AI-driven automation within a next-generation agentic SOAR platform.

Responsibilities

• Serve as the lead technical responder during security events in North American timezones, triaging complex alerts and acting as a core member of the cybersecurity incident response team.
• Participate in a 24x7 on-call rotation, providing senior escalation support for incidents and investigations.
• Engineer, maintain, and continuously tune detection logic across multiple data sources, using threat modeling to keep coverage current with the evolving attack landscape.
• Design detection coverage maps that document capabilities, identify blind spots, and inform logging and monitoring improvements.
• Build and maintain incident response runbooks, SOPs, and KPIs such as detection effectiveness, false positive rates, and mean time to detect, respond, and recover.
• Develop automation workflows, orchestration playbooks, and AI-driven tooling that accelerate detection engineering, threat hunting, and response.
• Conduct proactive, hypothesis-driven threat hunts across corporate and production environments.
• Mentor junior team members on detection engineering, operations, and incident response methodologies.

Requirements

• 5+ years of hands-on security operations experience with emphasis on incident response and detection engineering.
• Strong working knowledge of enterprise security tools such as EDR, NDR, CSPM, EASM, SIEM, SOAR, and cloud security platforms.
• Solid understanding of AWS cloud services and containerization technologies.
• Proficiency applying threat intelligence frameworks such as MITRE ATT&CK to assess coverage and gaps.
• Demonstrated ability to design new detection use cases from telemetry analysis, baselining, threat intel, and incident findings.
• Investigative mindset, intellectual curiosity, and commitment to staying current with emerging threats and adversary tactics.
• Industry certifications such as GCIH, GCFA, GIME, OSIR, or GEIR are strongly preferred.

Nice to have

• Experience with programming languages such as Python, JavaScript, or Go.
• Familiarity with infrastructure-as-code tools such as Terraform.
• Background in threat hunting, cyber threat intelligence, or digital forensics.

Benefits and work setup

• Remote-first work model within the candidate's Canadian province of residence (Ontario or British Columbia).
• Competitive base salary calibrated to working location, with annual performance bonuses and equity in a publicly traded company.
• Multiple health insurance options, flexible vacation with floating holidays, and a retirement savings program with company contribution.
• Monthly remote work stipend, annual development stipend, and family-forming benefits with generous parental leave top-up.