Senior Associate Security Engineering

Skills

About the Role

You will monitor and triage security alerts, investigate suspicious activity, and support incident response. You will coordinate with the managed security operations provider, improve monitoring coverage and alert quality, assist with vulnerability assessments, and maintain incident documentation and readiness materials.

Requirements

• 2–4 years of experience in security engineering, cloud security, or detection and response
• Experience investigating AWS CloudTrail events, GuardDuty alerts, Security Hub and Inspector findings, and WAF logs
• Incident response and threat-hunting skills
• Experience building and tuning SIEM and EDR detections
• Proficiency in Python, JavaScript, TypeScript, or a comparable scripting language
• Vulnerability-management experience
• Knowledge of least privilege, SSO, MFA, privileged access, secrets management, API authorization, and session security
• Ability to communicate findings, business impact, and recommended actions
• Experience with CrowdStrike, Wazuh, Trend Micro, JumpCloud, or equivalent platforms
• Experience integrating SAST, DAST, dependency scanning, and secrets scanning into CI/CD pipelines
• Experience building AI-assisted security workflows with evidence validation, controlled permissions, and human approval

Responsibilities

• Monitor security alerts from SIEM, EDR/XDR, and cloud security tools
• Triage alerts and escalate suspicious activity
• Validate alerts from the managed security operations provider
• Support incident response investigations and collect logs, indicators of compromise, and forensic data
• Follow incident-response playbooks and document actions
• Coordinate alerts, tickets, escalations, handoffs, and follow-ups with the managed security operations provider
• Maintain security monitoring coverage and log onboarding
• Tune alerts to reduce false positives and verify critical-system monitoring
• Assist with vulnerability assessments, attack simulations, remediation tracking, and retesting
• Maintain incident-response playbooks and runbooks
• Document incident learnings, alerts, and recurring issues
• Participate in tabletop exercises and security drills