Staff Security Engineer: AI‑Driven Detection & Incident Response

GoodLeap; Portland (OR); On-site; USD 167,000 - 193,000; Full time

Job summary

GoodLeap is seeking a Staff Security Engineer, Security Operations to protect its cloud environments, applications, endpoints, and corporate systems. You will design and tune detections, lead incident response, and manage security tooling to provide visibility across cloud, identity, endpoint, and email.

You will also mentor the security team and partner engineering teams, build AI agents and automation, and ensure controls meet SOC 2, PCI-DSS, and ISO standards.

Qualifications

• In-depth knowledge of Amazon AWS including security configuration, logging, and tooling.
• Hands-on experience in detection engineering, including SIEM query languages and detection-as-code.
• Hands-on experience in incident response, including log analysis and cloud/host investigation.
• Familiar with MITRE ATT&CK framework and OWASP Top 10.
• Knowledge of network and web protocols (TCP/IP, DNS, HTTP, TLS).
• Experience with EDR platforms (CrowdStrike Falcon).
• Experience with email security (phishing, BEC, DMARC/SPF/DKIM).
• Experience building automation in Python or similar language.
• Experience building or integrating LLM-based agents and workflows.
• Understanding AI-specific risks like prompt injection and data leakage.
• Experience in SOC 2, PCI-DSS, or ISO controls.
• Strong business and technical acumen with clear communication.

Responsibilities

• Design, build, test, and tune detections across cloud, identity, endpoint, and email telemetry.
• Lead incident investigations, containment, eradication, and recovery.
• Manage security tooling and automation for monitoring and response.
• Develop AI agents and automation for alert triage and investigation.
• Mentor security and partner engineering teams on security operations.

Skills

Detection engineering

Incident response

Security tooling

Automation (Python)

AI agents & workflows

Strong communicator

Multitask prioritization

Tools

CrowdStrike Falcon

SIEM

CloudTrail

GuardDuty

Security Hub

Job description

GoodLeap is seeking a Staff Security Engineer, Security Operations to protect its cloud environments, applications, endpoints, and corporate systems. You will design and tune detections, lead incident response, and manage security tooling to provide visibility across cloud, identity, endpoint, and email.

You will also mentor the security team and partner engineering teams, build AI agents and automation, and ensure controls meet SOC 2, PCI-DSS, and ISO standards.