Senior Security Operations Engineer - Threat Detection & IR

StubHub; Los Angeles (CA); Hybrid; USD 200,000 - 250,000; Full time

Benefits offered by this job

Unlimited Flex Time Off

Competitive compensation and equity

Health, Vision and Dental Insurance

401(k)

Job summary

StubHub is seeking a Security Operations Engineer to scale incident response, threat detection, and SIEM tooling across cloud, endpoint, and network data sources. You will write production-quality code to automate detection and response, build detection pipelines, and mature StubHub’s SOC-less approach to Detection & Response.

You will collaborate with Cloud and Infrastructure Security, Identity Engineering, and cross-functional stakeholders to shape how threats are detected, responded to, and

Qualifications

• 3 years of experience in security engineering, security operations, or related discipline.
• Hands-on experience leading incident response efforts, including complex multi-system investigations.
• Proficiency in at least one programming language (Python strongly preferred; Go or Ruby also relevant).
• Familiarity with SIEM platforms and data onboarding; experience with cloud log sources and threat modeling.
• Experience mapping detections to MITRE ATT&CK and collaborating with cross-functional teams.

Responsibilities

• Lead and coordinate security incident response end-to-end: detection, triage, containment, eradication, recovery, and post-incident review.
• Design, build, and tune detection rules, event correlation logic, and behavioral analytics across cloud, endpoint, network, and application data sources.
• Own log collection strategy: define what gets collected, fidelity, and retention across cloud providers, SaaS, endpoints, and internal services.
• Write internal software to automate detection, response, enrichment, and reporting workflows (Python/Go).
• Develop dashboards, metrics, and reporting to communicate security health to leadership.
• Collaborate with Legal, Procurement, and Engineering to remediate third-party security risk.
• Maintain parsers and ETL pipelines to ensure high-quality signal in SIEM.

Skills

Incident Response

Threat Detection

SIEM

Python

Go

Cloud Security

Data Analytics

Tools

Splunk

ELK

Chronicle

Panther

AWS

GCP

Azure

Job description

StubHub is seeking a Security Operations Engineer to scale incident response, threat detection, and SIEM tooling across cloud, endpoint, and network data sources. You will write production-quality code to automate detection and response, build detection pipelines, and mature StubHub’s SOC-less approach to Detection & Response.

You will collaborate with Cloud and Infrastructure Security, Identity Engineering, and cross-functional stakeholders to shape how threats are detected, responded to, and