Staff Security Engineer — Threat Detection & SIEM

Envoy; San Francisco (CA); Vor Ort; USD 190.000 - 270.000; Vollzeit

Zusammenfassung

Envoy in San Francisco seeks a Staff Security Engineer to own and evolve our security operations and threat detection across infrastructure, applications, and endpoints. You will lead detection strategy, implement detection-as-code, and drive scalable, automated defenses with a focus on measurable improvements in security metrics.

This on-site role collaborates with Infrastructure, Platform, and Workplace teams to enhance visibility, orchestrate incident response, and mentor peers toward

Qualifikationen

• 10+ years of Security Engineering, SRE, or Infra with security focus.
• Strong experience designing or improving security monitoring, detection, or SIEM systems.
• Cloud environments (AWS) including IAM, networking, and logging at scale.
• Experience with endpoint detection and response tools such as SentinelOne.
• Deep experience with logs, events, and telemetry for high-signal detections.
• Strong programming or scripting skills (Python, Go) for automation.
• Understanding attacker behavior and translating threats into detection strategies.
• Experience defining alerting models and reducing noise while maintaining coverage.
• Ability to operate in ambiguous environments and define structure.
• Cross-functional communication to influence engineering and leadership.
• Outcome-oriented mindset to reduce real risk and improve ops.

Aufgaben

• Own the design and evolution of threat detection and security operations.
• Define detection strategy across cloud, apps, and endpoints.
• Establish and improve SIEM and monitoring architecture with quality signals.
• Design and implement detection-as-code standards for build, test, maintenance.
• Drive visibility into all critical assets; ensure endpoints and services are monitored.
• Lead endpoint security monitoring and integration into detection workflows.
• Roll out automated security controls, including secrets rotation for high-risk systems.
• Define alerting strategy, severity models, escalation paths, and on-call expectations.
• Lead investigations into complex signals with root-cause analysis and response.
• Partner with engineering to improve instrumentation and high-quality signals.
• Define and track metrics like MTTD and MTTR; drive improvements.
• Mentor engineers to raise team capability in detection and security operations.

Kenntnisse

Security Engineering

Threat Detection

SIEM

AWS

Endpoint Security

Python

Go

Automation

Threat Intel

Alerting Models

Mentoring

Tools

SentinelOne

Jobbeschreibung

Envoy in San Francisco seeks a Staff Security Engineer to own and evolve our security operations and threat detection across infrastructure, applications, and endpoints. You will lead detection strategy, implement detection-as-code, and drive scalable, automated defenses with a focus on measurable improvements in security metrics.

This on-site role collaborates with Infrastructure, Platform, and Workplace teams to enhance visibility, orchestrate incident response, and mentor peers toward