Senior Security Operations: Detection & Response (Remote)

Point; San Francisco (CA); On-site; USD 151,000 - 167,000; Full time

Benefits offered by this job

Health benefits

Unlimited PTO

Remote & onsite options

Parental leave

Equity

401K

Job summary

Point is seeking a Senior Security Operations Analyst to join our remote U.S. team. You will drive incident response, design detections, and automate workflows across AWS and Google Workspace, reducing risk for hundreds of thousands of homeowners.

With 5+ years in security operations, you will own on-call duties, write runbooks, and deliver auditable security metrics. This is a high-visibility role offering broad autonomy and impact.

Qualifications

• 5+ years of experience in security operations, incident response, SOC, or detection engineering (mid-to-senior individual contributor).
• Hands-on experience running or actively participating in an on-call / incident-response rotation, independently.
• Strong SIEM skills — authoring and tuning detections, correlation rules, and dashboards (Coralogix, Splunk, Elastic, Microsoft Sentinel, or similar).
• Practical cloud security experience in AWS and Google Workspace, including identity and log sources.
• Demonstrated ability to investigate and contain incidents end to end — e.g., phishing/AiTM, account takeover, business email compromise, and cloud/identity threats.
• Working knowledge of vulnerability management and coordinating remediation with engineering teams.
• Scripting and automation ability (Python or similar) for detection-as-code and SOAR-style workflows.
• Clear written and verbal communication — able to produce runbooks, metrics, and audit-ready documentation.
• Comfortable operating with autonomy on a small team and owning problems end to end.
• Authorized to work in the United States, and able to participate in an off-hours on-call rotation.

Responsibilities

• Rotate on-call and lead response: share the 24/7 on-call and incident-response rotation with the security lead — triaging, investigating, and driving containment of security alerts and incidents.
• Own response documentation: build and maintain incident-response runbooks, escalation paths, and post-incident reviews so response is consistent and repeatable.
• Engineer detections: build, tune, and maintain SIEM detections, correlation rules, dashboards, and reporting in Coralogix across cloud and identity log sources.
• Close coverage gaps: reduce false positives and onboard new log sources to eliminate detection blind spots.
• Own vulnerability management: run day-to-day vulnerability management — prioritize findings, coordinate remediation with system owners, and report on risk reduction across cloud and endpoints.
• Automate response: develop detection-as-code and lightweight automation/SOAR so common alerts self-triage and response is faster and repeatable.
• Add operational redundancy: serve as a redundant administrative and response path so containment is never bottlenecked on a single person.
• Report and evidence: produce recurring security metrics and reporting for leadership, and supply control evidence for audits.
• Apply AI to the workflow: use AI/LLM tooling to accelerate investigation, correlation, and detection engineering.
• Improve the program: contribute to continuous improvement of the security-operations program, tooling, and threat monitoring.

Skills

Security operations

Incident response

SIEM tuning

Cloud security

Vulnerability management

Python scripting

On-call rotation

Communication

Tools

Coralogix

Splunk

Elastic

Microsoft Sentinel

AWS

Google Workspace

Job description

Point is seeking a Senior Security Operations Analyst to join our remote U.S. team. You will drive incident response, design detections, and automate workflows across AWS and Google Workspace, reducing risk for hundreds of thousands of homeowners.

With 5+ years in security operations, you will own on-call duties, write runbooks, and deliver auditable security metrics. This is a high-visibility role offering broad autonomy and impact.