Staff Security Engineer: Detection & Response Leader

IBM; Tucson (AZ); On-site; USD 140,000 - 190,000; Full time

Job summary

Confluent is seeking an experienced security engineer to join our infrastructure security engineering team with a focus on Detection and Response. You will apply threat detection and response expertise to build foundational systems that keep our cloud environments secure and observable.

Collaborating with engineering and compliance teams, you will drive high-impact projects, mentor junior engineers, and help define strategy and metrics for detection and response across the organization while

Qualifications

• 8+ years of relevant industry experience in detection and response or similar security engineering role in a cloud-first environment.
• Deep, expert-level domain knowledge in detection engineering and security incident response.
• Experience in instrumenting telemetry and building high-quality detections in large-scale, heterogeneous deployments (e.g., Kubernetes, containers, multi-cloud).
• Proficient ability in writing code using Python or Golang to design complex tooling, automation, and data pipelines.
• Demonstrated experience with effective incident response and containment practices, preferably in a cloud-first environment.
• Experience with operating open-source and/or commercial solutions for logging and security event management (e.g. SIEM, log aggregation, SOAR, etc).
• Ability to work alongside a remote team, using a data-driven mindset to propose and own engineering decisions, and the capability to drive consensus across ambiguous, organizational-wide challenges.

Responsibilities

• Architect, build and maintain scalable cloud-based security monitoring solutions, across logging pipelines, ETL jobs, and SIEM ingestion.
• Drive the long-term roadmap for threat hunting by translating modern adversary tradecraft (TTPs) and threat models into high-signal detection strategies to ensure our critical infrastructure operates safely.
• Build processes and workflows to triage security alerts and drive incidents to closure, including participating in a shared on-call rotation for incident response.
• Research new threat attack vectors and ensure that our detection and response program is in line with the current threat landscape.
• Proactively improve the quality of our detection rules by defining and tracking key metrics (e.g., coverage, precision, MTTD), working directly with engineering teams to eliminate classes of issues.
• Collaborate with engineering teams in building logging pipelines needed to gather relevant security telemetry, ensuring new infrastructure ships with secure-by-default visibility.
• Contribute to strategy, risk management and prioritization for all efforts around detection and response.
• Provide technical guidance, mentorship, and leadership to other engineers, raising the bar for security operations across the organization.

Skills

Security engineering

Python

Golang

Kubernetes

Containers

Multi-cloud

Incident response

Threat hunting

SIEM

SOAR

Telemetry

Cloud-first

Education

Master's Degree

Tools

SIEM

Log aggregation

SOAR

Job description

Confluent is seeking an experienced security engineer to join our infrastructure security engineering team with a focus on Detection and Response. You will apply threat detection and response expertise to build foundational systems that keep our cloud environments secure and observable.

Collaborating with engineering and compliance teams, you will drive high-impact projects, mentor junior engineers, and help define strategy and metrics for detection and response across the organization while