Senior Software Engineer – Observability & Detection

Averro; Fremont (CA); On-site; USD 170,000 - 230,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Life insurance

401(k)

Paid time off

Job summary

Averro is seeking a Senior Software Engineer – Observability & Detection to join a growing technology company with multiple site operations. You will scale log analytics and security detection, collaborating with IT, software, cloud, and AI specialists.

Expect end-to-end data collection from Windows, Linux, endpoints, devices, and AWS. The role emphasizes AI coding agents, code-based detection rules, and a fast, cost-conscious pipeline.

Qualifications

• 5+ years in software, platform, or security engineering.
• Deep experience in Python, Go or TypeScript.
• Scripting across Bash and PowerShell.
• Experience with high-volume data pipelines and AWS.

Responsibilities

• Build end-to-end collection and routing of security/operational events.
• Pull telemetry from Microsoft 365 and Entra ID and correlate it.
• Design retention tiers and ingestion filters for scale.
• Develop intrusion detection and anomaly detection rules.
• Tune alerts and enable triage with written incident explanations.
• Create verification tooling for configuration drift and policy checks.
• Express compliance checks as code for audits.

Skills

Python

Go

TypeScript

Bash

PowerShell

Security engineering

Data pipelines

AWS

Containers

Tools

OpenTelemetry collectors

Fluent Bit

Vector

Kinesis Data Firehose

OpenSearch

KQL

Job description

Benefits

Health, dental, and vision insurance, life insurance, 401(k), and paid time off

Role & Responsibilities

Averro is seeking a Senior Software Engineer – Observability & Detection to join a growing technology company with operations across multiple sites. This role is the nervous system: knowing the real state of every server, workload, and identity, everywhere, all the time. You will scale the company’s log analytics and security detection capabilities, working alongside IT engineers, software developers, cloud engineers, and AI specialists. The team uses AI coding agents as everyday collaborators and expects you to work the same way.

• Build end-to-end collection, parsing, normalization, and routing of security and operational events from Windows and Linux servers, endpoints, network devices, and AWS accounts across every site into a single query layer
• Pull identity and endpoint telemetry from Microsoft 365 and Entra ID and correlate it against everything else collected
• Design retention tiers and ingestion filters up front so the pipeline stays fast and costs stay predictable as volume grows
• Build intrusion detection, firewall and network monitoring, credential-exposure signals, and anomaly detection on infrastructure behavior, with detection rules written as code, kept in version control, and validated in CI
• Tune alerting so a small team can respond to it, and investigate what fires: triage, scoping, and a written answer to what happened
• Build continuous verification tooling that checks deployed security, network segmentation, and patch policy against what is running, and detect configuration drift between intended and observed state
• Express compliance checks as code to produce the evidence auditors ask for, so regular security audits are passed cleanly without rebuilding spreadsheets

Essential Qualifications

• 5+ years of software, platform, or security engineering experience, with real depth in at least one of Python, Go, or TypeScript, plus scripting across mixed environments (Bash and PowerShell)
• Experience building high-volume data pipelines, with sound schema and pipeline decisions that control cost and query latency
• Production experience with AWS and containers
• Defensive security fundamentals: zero-trust boundaries, IAM least privilege, secret rotation, and failure modes in a mixed cloud and on-premise estate
• Depth in either AWS security telemetry (Security Lake, GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, queried through OpenSearch or Athena) or Microsoft security telemetry (Sentinel, Defender XDR, Defender for Identity, Log Analytics, and KQL), with working familiarity in the other
• Daily use of AI coding agents, with a clear view of where they are reliable, where they need bounding, and how to review what they produce

Bonus Qualifications

• Terraform or OpenTofu experience
• Hands-on experience with OpenTelemetry collectors, Fluent Bit, Vector, or Kinesis Data Firehose
• Schema normalization with OCSF or Elastic Common Schema
• Detection engineering with portable rules (Sigma or equivalent) mapped to MITRE ATT&CK
• OS and network telemetry experience: Windows Event Logs, Sysmon, Active Directory and Entra authentication events, NetFlow or IPFIX, DNS logs, and IDS engines such as Zeek or Suricata
• Experience with CIS Controls or NIST CSF, ideally including having been through a real audit on the answering side
• Familiarity with verification tooling such as osquery, Steampipe, or AWS Config

Why Averro?

Averro is a Veteran‑Owned organization dedicated to delivering innovative talent solutions, business consulting, and technology services that propel businesses and careers forward. We live by our ethos: Be Curious | Build Trust | Empower Each Other. These values show in our commitment to client satisfaction, timely support, and unmatched consultant care. Our Aim – Your Ascent.

Averro is an equal opportunity employer, and we are committed to diversity, equity, and inclusion in the workplace. All qualified applicants will receive consideration for employment, regardless of criminal histories, consistent with legal obligations.

All employment decisions shall be made without regard to age, race, creed, color, religion, sex, national origin, ancestry, disability status, veteran status, sexual orientation, gender identity or expression, genetic information, marital status, citizenship status or any other basis as protected by federal, state, or local law.

View our privacy policy here: https://www.averro.com/legal/privacy-policy