Security Operations Engineer
Alpaca is a brokerage infrastructure company providing developer APIs for stocks, options, fixed income, and crypto trading, plus tokenization infrastructure for TradFi–DeFi markets.
Funding history
Investors
About Alpaca
Alpaca provides API-first brokerage infrastructure for fintechs, institutions, algorithmic traders, and developers. Its offerings include Broker API, Trading API, market data, self-clearing brokerage services, crypto services, and the Instant Tokenization Network for in-kind minting and redemption of tokenized assets.
Skills
About the Role
You will operate and improve SIEM and SOAR capabilities by onboarding logs, developing and tuning detections, maintaining dashboards, and automating response actions. You will investigate alerts, support incidents with evidence and containment, write runbooks, track security operations metrics, conduct threat hunts, and participate in the security on-call rotation.
Requirements
- 3+ years of experience in Security Operations or detection engineering
- Hands-on experience operating and tuning a SIEM
- Experience building SOAR playbooks or equivalent response automation
- Experience working with Linux
- Scripting or automation experience with Python or Bash
- Experience onboarding and parsing cloud, identity, and SaaS log sources
- Alert investigation skills across identity, endpoint, network, and cloud environments
- Understanding of attacker techniques and detection methodologies
- Experience supporting security incidents, including evidence collection, detection queries, and containment
- Willingness to participate in an on-call rotation
Responsibilities
- Onboard security log sources and perform parsing, normalization, and data-quality checks
- Build, test, and tune detection rules using threat intelligence, incident learnings, and attack techniques
- Tune and enrich detections to keep alerts actionable
- Maintain detection coverage for critical systems and priority attack techniques
- Build and maintain operational dashboards for alert volume, ingest health, and response status
- Support security incidents with evidence collection, detection queries, and containment actions
- Develop alert-handling and incident-response runbooks and escalation paths
- Track and report MTTD and MTTR metrics
- Participate in the Security Operations on-call rotation
- Design, build, and maintain SOAR playbooks for enrichment, containment, ticketing, and notification
- Triage, investigate, and respond to security alerts
- Conduct threat hunts and turn findings into new detections
Benefits
- Stock options
- Health benefits
- One-time USD 500 new-hire home-office setup
- USD 150 monthly stipend via a Brex Card
