Sr. Security Engineer, Threat Detection and Response

Ektello; San Francisco (CA); Remote; USD 208,000 - 312,000; Full time

Job summary

Ektello is seeking a Sr. Security Engineer for Threat Detection & Response (TDR) to lead incident investigation and response efforts in a 100% remote capacity. You will mentor peers and define strategic vision for threat detection, enabling scalable security across data, systems, and cloud environments.

The role emphasizes proactive threat hunting, automation, and collaboration with Legal, Privacy, and executives to drive robust security practices and incident lifecycle improvements.

Qualifications

• 5+ years of hands-on security operations including investigations, incident response, and threat detection.
• Proficiency in Python scripting for automation.
• Strong SQL and Pandas for data analysis and telemetry review.
• Deep knowledge of MITRE ATT&CK framework and Cyber Kill Chain concepts.
• Experience automating detection and incident response workflows.

Responsibilities

• Perform high-priority investigations into security incidents using forensics and data analytics.
• Develop detection and automation solutions to scale incident response.
• Conduct proactive threat hunting across corporate and cloud environments.
• Collaborate with Legal, Privacy, and executives on investigations.
• Identify telemetry gaps and expand coverage across infrastructure.

Skills

Security operations

Python scripting

SQL

Pandas

MITRE ATT&CK

Cyber Kill Chain

Automation

Tools

AWS

Elasticsearch (ELK)

Job description

Sr. Security Engineer – Threat Detection & Response (TDR)

Location: (100% Remote) Position Type: 12+ Month Contract (Contract-to-Hire with Multi-Extension Capability) Pay Rate: $100.00 – $150.00 / hour (W2)

About the Role

The Threat Detection and Response (TDR) team is focused on automating security detection, responding to security incidents, and collaborating with partner teams to build capabilities that support the complete incident lifecycle. As the front-line defense, this team detects, investigates, and responds to both internal and external security threats and malicious activity across data, systems, and infrastructure. As a Senior Security Engineer, you will play a pivotal role in defining and executing our strategic vision for threat detection and incident response processes while mentoring fellow team members. In this high-impact position, you will build, optimize, and scale security capabilities to deliver world-class threat detection and incident management.

The Difference You Will Make

• Drive Innovation: Define and execute novel approaches to detecting, containing, and mitigating high-priority threats and security incidents.
• Proactive Security Elevation: Partner with cross-functional teams to improve overall enterprise security based on post-investigation root-cause analysis, effectively eliminating entire classes of security vulnerabilities.
• Mentorship & Leadership: Guide and mentor engineering peers while influencing security best practices across the organization.

A Typical Day

• Incident Investigation & Response: Perform high-priority investigations into security incidents leveraging digital forensics, data analytics, and deep technical capabilities.
• Detection & Automation Engineering: Utilize coding, data analytics, and investigative skills to hunt for threats, build automation models, and streamline incident response workflows at scale.
• Proactive Threat Hunting: Conduct threat hunting across corporate and cloud production environments to identify anomalous or suspicious activity before it escalates.
• Cross-Functional Collaboration: Partner closely with internal engineering teams to deploy advanced detection solutions, while coordinating with Legal, Privacy, and Executive stakeholders on complex investigations.
• Visibility & Coverage Expansion: Identify infrastructure logging gaps and collaborate with business partners to onboard telemetry for enhanced threat visibility.

Qualifications & Required Expertise

Core Qualifications

• 5+ years of hands-on, technical experience in security operations, including investigations, incident response/management, digital forensics, threat hunting, threat intelligence, or detection engineering.
• Strong Scripting & Data Skills: Proficiency in Python (or a similar scripting language).
• Frequent hands-on use of SQL and Pandas for analytical tasks.
• Framework Mastery: In-depth knowledge and practical application of the MITRE ATT&CK framework and the Cyber Kill Chain across modern threat landscapes.
• Automation: Demonstrated experience automating security detection and incident response workflows.

Preferred Skills

• Hands-on experience with AWS services and architecture (EC2, S3, Lambda, RDS).
• Familiarity with Elasticsearch (ELK stack) or comparable SIEM/log aggregation solutions.

Professional & Interpersonal Skills

• Leadership & Influence: Ability to lead cross-functional teams through complex, ambiguous situations through influence rather than authority.
• Composure Under Pressure: Ability to work calmly, collaboratively, and decisively in critical, high-stress incident response scenarios.
• Autonomy & Organization: Self-motivated, creative problem-solver capable of working independently with minimal guidance while managing multiple priorities efficiently.

#IND #LI-DC2