Staff SecOps Engineer
Ledger helps you keep your digital assets safe using certified hardware wallets and management software that protect against online threats.
Funding history
Projects
About Ledger
Ledger provides secure storage and management for digital assets through certified hardware wallets and software. The hardware wallets store private keys offline to protect against hacks and malware, while Ledger Live software lets users buy, sell, and manage multiple cryptocurrencies. Institutions can use Ledger Enterprise for secure custody and governance. All products support major blockchains and Web3 applications with regular security updates.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You'll be one of the most senior technical voices on the team: a hands-on generalist who can dig deep into any layer of the stack, step back to see the whole picture, and bring clear, calm judgment when the stakes are highest. You'll anchor critical-incident response, set the direction on detection and threat hunting, evolve the architecture and the Agentic SOC, and raise the bar across the team through standards, playbooks, and mentoring.
Requirements
- Approximately 9 years or equivalent depth in security operations, incident response, and CSIRT
- Ability to lead technically under pressure and stay structured amid ambiguity
- Hands-on SIEM experience, ideally Splunk, including writing and refining investigation and detection queries
- Cloud-security fundamentals, ideally AWS, including IAM, CloudTrail, GuardDuty, workloads, containers, and Kubernetes/EKS
- Comfort automating with Python, Bash, APIs, GitHub Actions, or a SOAR platform
- Clear communication, strong documentation habits, and sound judgment with sensitive information
Responsibilities
- Bring senior technical leadership to complex incidents across cloud, corporate, endpoints, identities, and data center environments
- Lead complex investigations end to end including root cause analysis, forensics, timeline reconstruction, and remediation
- Serve as a trusted escalation point and keep handling, escalation, and documentation rigorous and consistent
- Set the direction of detection strategy, architecture, and methodology
- Contribute to proactive threat hunting by turning CTI and OSINT into risks caught before they reach Ledger
- Translate threat intelligence into concrete security posture improvements
- Drive evolution of the Splunk and Torq SOAR setup for detection, triage, and response
- Focus on detection quality, data standardization, and usability
- Contribute to the Agentic SOC and log/data pipeline architecture
- Help automate the team's reporting
- Bring cloud-security judgment using AWS and EKS/Kubernetes
- Use Wiz to prioritize exposure at scale
- Define standards, playbooks, and runbooks
- Mentor senior and junior engineers through review, pairing, and knowledge sharing
- Partner with Engineering, Infrastructure, IT, and Cloud
