Staff Security Engineer

gh; United States; Hybrid; USD 134,000 - 184,000; Full time

Job summary

gh is seeking a seasoned security engineering leader to strengthen detection, investigation, and response across on-prem, cloud, and AI-enabled environments. You will drive detection engineering, threat intelligence, automation, and incident response while improving monitoring and risk practices enterprise-wide.

You will build detections across infrastructure, cloud, and identity platforms; lead investigations with external MSS providers; and create dashboards to track posture and performance.

Qualifications

• Eight+ years in security engineering, security operations, detection engineering, or incident response.
• Hands-on experience creating, testing, and tuning SIEM and endpoint detection rules.
• Experience leading technical investigations and coordinating containment, eradication, and recovery.
• Knowledge of AWS investigations, cloud telemetry, and identity/access logs.
• Strong written and verbal communication; understanding of AI/ML security, automation, and governance.

Responsibilities

• Build and maintain threat detections across infrastructure, endpoints, cloud services, SaaS, and identity platforms; test and tune them to improve coverage and reduce false alerts.
• Work with a managed detection and response provider to improve detection rules, investigation quality, escalations, and response workflows.
• Participate in incident response, including investigation, containment, eradication, recovery, and post-incident review.
• Monitor cloud environments and relevant telemetry, including AWS activity, network flow, workload, and SaaS integration logs.
• Create dashboards and reports that track detection coverage, security operations performance, and overall posture.
• Document operational playbooks, assess AI-assisted security capabilities, and mentor engineers across security operations and engineering.

Skills

SIEM tuning

Endpoint detection

Incident response

Cloud security

Threat intelligence

Communication

Tools

MISP

Yeti

OpenCTI

Job description

Role overview

Strengthen an organization’s ability to detect, investigate, and respond to security threats. This hands-on technical leadership role spans detection engineering, threat intelligence, cloud and identity monitoring, automation, and incident response. You will improve security operations while helping establish sound monitoring and risk practices for AI systems and agents used across the enterprise.

Responsibilities

• Build and maintain threat detections across infrastructure, endpoints, cloud services, SaaS, and identity platforms; test and tune them to improve coverage and reduce false alerts.
• Work with a managed detection and response provider to improve detection rules, investigation quality, escalations, and response workflows.
• Participate in incident response, including investigation, containment, eradication, recovery, and post-incident review.
• Monitor cloud environments and relevant telemetry, including AWS activity, network flow, workload, and SaaS integration logs.
• Create dashboards and reports that track detection coverage, security operations performance, and overall posture.
• Document operational playbooks, assess AI-assisted security capabilities, and mentor engineers across security operations and engineering.

Requirements

• At least eight years in security engineering, security operations, detection engineering, or incident response.
• Strong practical experience creating, testing, and tuning SIEM and endpoint detection rules in a security operations environment.
• Experience leading technical investigations and coordinating incident containment, eradication, and recovery.
• Experience with endpoint detection tools, identity and access logs, AWS investigations, and cloud security telemetry.
• Ability to improve alert quality, account for business context, and work effectively with external managed security or SIEM providers.
• Strong written and verbal communication skills, including the ability to write threat assessments and reports; understanding of AI and machine-learning security, automation, and governance considerations.

Nice to have

• Experience operating open-source threat intelligence platforms such as MISP, Yeti, or OpenCTI.

Benefits and work setup

• The listing identifies the position as open to remote candidates in the United States. Employees who live within 50 miles of a facility are expected to work onsite Monday, Tuesday, and Thursday.
• The listing provides a base salary range of $133,960–$184,195 for most U.S. locations, with a separate range of $141,840–$195,030 for Colorado; the final offer depends on location and qualifications.