Staff Security Engineer, Threat Detection & SecOps

Envoy; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Envoy is seeking a Staff Security Engineer to lead threat detection, security operations, and automation. You will own detection strategies across cloud, applications, and endpoints and evolve our SIEM and monitoring capabilities in a large-scale environment.

You will collaborate with Infrastructure, Platform, and Workplace teams to ensure comprehensive visibility and rapid incident response. This on-site role requires four days per week in our San Francisco HQ.

Qualifications

• 10+ years in security engineering, SRE, or infra with security focus.
• Proven experience designing or improving security monitoring, detection, or SIEM systems.
• Strong AWS cloud experience with IAM, networking, and logging at scale.

Responsibilities

• Own the design and evolution of threat detection and security operations capability.
• Define detection strategy across cloud, apps, and endpoints.
• Establish and improve SIEM and monitoring architecture for signal quality and coverage.
• Design detection-as-code practices and standards for detection logic.
• Drive visibility of assets to ensure telemetry is high quality.
• Lead endpoint security monitoring and integration into centralized workflows.
• Define alerting models, escalation paths, and on-call expectations.
• Lead investigations and root-cause analyses of complex signals.
• Collaborate with engineering to improve instrumentation and signals emitted by systems.
• Track MTTD and MTTR and drive measurable improvements.
• Mentor engineers to raise team capability in detection and security operations.

Skills

Security engineering

SIEM

AWS

Endpoint security

Python/Go

Threat detection

Automation

Incident response

Cross-functional comms

Mentoring

Tools

SentinelOne

Job description

Envoy is seeking a Staff Security Engineer to lead threat detection, security operations, and automation. You will own detection strategies across cloud, applications, and endpoints and evolve our SIEM and monitoring capabilities in a large-scale environment.

You will collaborate with Infrastructure, Platform, and Workplace teams to ensure comprehensive visibility and rapid incident response. This on-site role requires four days per week in our San Francisco HQ.