Staff Security Engineer: Threat Detection & DaC Automation

Envoy; San Francisco (CA); On-site; USD 180,000 - 260,000; Full time

Job summary

Envoy is seeking a Staff Security Engineer to build and scale our Threat Detection and Security Operations. This hands-on role focuses on writing code, creating detection systems, and automating threat detection and response across infrastructure, applications, and endpoints.

You will lead the design and rollout of automated controls, integrate telemetry, and mentor engineers to raise the team’s detection capabilities—while collaborating with multiple orgs to improve overall security posture.

Qualifications

• 10+ years in Security Engineering, SRE, or Infrastructure with a security focus.
• Strong programming or scripting skills (Python, Go) with automation experience.
• Hands-on with detection as code (DaC) including testing and deployment workflows.
• Proven track record building or improving security monitoring, SIEM, and analytics.
• Experience with cloud environments (AWS) and IAM, networking, logging.

Responsibilities

• Design and evolve threat detection and security operations from the ground up.
• Write detection logic and maintain detection tests, version control, and deployment workflows.
• Build automation and integrations connecting telemetry, detections, and response workflows.
• Define detection strategy across cloud, apps, and endpoints.
• Improve SIEM architecture, signal quality, coverage, and scalability.
• Lead investigations and drive root-cause analysis and response.
• Define alerting models, severity, escalation, and on-call practices.
• Mentor engineers to raise capability in detection engineering and security operations.

Skills

Python

Go

Detection as Code (DaC)

Automation

SIEM

Cloud security

Threat detection

Mentoring

Education

Bachelor's degree in CS or related field

Tools

SentinelOne

Job description

Envoy is seeking a Staff Security Engineer to build and scale our Threat Detection and Security Operations. This hands-on role focuses on writing code, creating detection systems, and automating threat detection and response across infrastructure, applications, and endpoints.

You will lead the design and rollout of automated controls, integrate telemetry, and mentor engineers to raise the team’s detection capabilities—while collaborating with multiple orgs to improve overall security posture.