FREE ACCESS
5,000–10,000 jobs/day
See all jobs on JobTailor
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Tech Stack
Tools & technologiesBigQueryCloudGoogle Cloud PlatformPythonSDLCTerraform
About the role
Key responsibilities & impact- Own our SIEM-of-record end-to-end; take it from deployed to operated: finish and harden log-source onboarding (GCP audit logs, Okta, Google Workspace, GitHub, endpoint telemetry) and own normalization, ingest health and the operating rhythm.
- Build detection-as-code: grow the first high-signal rules into a versioned, peer-reviewed rule set (Sigma / YARA-L / scheduled queries) mapped to MITRE ATT&CK and tuned hard against false positives.
- Drive MTTD down to minutes on the attack paths that matter; identity abuse, service-account impersonation, bulk data access, CI/CD compromise.
- Incident response: rehearse playbooks, lead investigations and forensics, and support breach-notification workflows with the compliance team.
- Run the cloud-findings triage loop (Security Command Center / CNAPP)
- Harden our Google Cloud estate (IAM least privilege, org policies, VPC Service Controls, GKE security, Cloud Armor) and codify everything in Terraform.
- Secure the CI/CD pipeline and SDLC (SAST, dependency and secrets scanning, supply-chain controls) and contribute to threat modeling of new features, including our AI/LLM surfaces.
- Strengthen the identity plane with IT — Okta policy hardening, phishing-resistant MFA (FIDO2/passkeys), SSO/SCIM coverage, joiner-mover-leaver automation — and route EDR and email-security telemetry into your detections.
Requirements
What you’ll need- 5–8+ years in security engineering, including at least 2–3 years hands-on experience in detection engineering, SOC or incident response.
- Proven experience writing detection rules as code (Sigma, YARA-L or equivalent) and tuning them in production.
- Python automation (event pipelines, alert enrichment, BigQuery) and Terraform
- Incident response and forensics fundamentals; comfortable moving between an IAM review, a CI hardening PR and an Okta policy change
- Excellent communication in English able to work cross-functionally with engineering, compliance and IT.
- GKE Autopilot & admission controllers, SIEM operations (Google SecOps / Elastic / Panther), or experience in healthcare / another regulated industry is a plus.
Benefits
Comp & perks- Stock ownership
- 100% healthcare coverage
- Meal vouchers
- Public transportation costs covered at 50%
- Exercise class during the workday: Yoga, running, pilates, HIIT
- Unlimited budget for book purchases, so you can continue to learn about IT, security, and leadership
- Culture of trust & accountability — your output matters more than your clock-in time
ATS Keywords
✓ Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills & Tools
detection engineeringincident responseforensicsdetection rules as codePythonTerraformGKE securitySASTdependency scanningsecrets scanning
Soft Skills
excellent communicationcross-functional collaboration