Staff Security Engineer: Threat Detection & SIEM Lead

Envoy; San Francisco (CA); On-site; USD 180,000 - 280,000; Full time

Job summary

Envoy is seeking a Staff Security Engineer to own and evolve our Security Operations and Threat Detection capabilities at our San Francisco HQ. You will define detection across cloud, applications, and endpoints, and design an automation-forward security program.

You will mentor engineers, drive metrics like MTTD and MTTR, and collaborate with Infrastructure and Platform teams to ship high-signal detections and scalable security controls.

Qualifications

• 10+ years of experience in Security Engineering, SRE, or Infra with a security focus.
• Proven experience designing or improving security monitoring and SIEM.
• Strong cloud experience (AWS), IAM, networking, and logging at scale.
• Experience with endpoint detection and response tooling.

Responsibilities

• Own the design and evolution of threat detection and security operations.
• Define detection strategy across cloud, apps, and endpoints.
• Establish and improve SIEM and monitoring architecture for quality and scale.
• Design and implement detection-as-code practices and standards.
• Drive visibility of assets; ensure endpoints and identities are monitored.
• Lead endpoint security monitoring including integration into workflows.
• Roll out automated security controls, including secrets rotation for high-risk systems.
• Define alerting strategy, severity models, and on-call expectations.
• Lead investigations and root-cause analysis for complex signals.
• Partner with engineering to improve instrumentation and signals quality.
• Define and track MTTD/MTTR and drive measurable improvements.
• Mentor engineers to raise security operations capability.

Skills

Security engineering

SRE / Infra security

Python/Go scripting

Cloud experience

SIEM/detection systems

Tools

SentinelOne

SIEM

Job description

Envoy is seeking a Staff Security Engineer to own and evolve our Security Operations and Threat Detection capabilities at our San Francisco HQ. You will define detection across cloud, applications, and endpoints, and design an automation-forward security program.

You will mentor engineers, drive metrics like MTTD and MTTR, and collaborate with Infrastructure and Platform teams to ship high-signal detections and scalable security controls.