Enhance and maintain Pantheon’s SIEM, building detections across cloud, endpoint, and identity sources; tune alerts to reduce noise and increase actionable insights
Lead incident response workflows, build playbooks, conduct tabletop exercises, and proactively hunt for malicious activity across Pantheon’s environment
Build and scale automated workflows for alert triage, enrichment, and response using SOAR, APIs, and scripting
Partner with Engineering and Infrastructure teams to triage vulnerabilities, reduce attack surface, and operationalize remediation
Create and operate automated controls to detect and stop account abuse, credential attacks, and platform misuse
Strengthen detection around IAM, SSO, and privileged access events with a zero-trust lens
Represent SecOps in business continuity and disaster recovery planning, ensuring operational readiness during crises
Define and deliver meaningful SecOps metrics to leadership, demonstrating security effectiveness and highlighting areas for improvement
Train engineers and incident responders in SecOps processes, tools, and best practices
Requirements
10 years of relevent experience
Proven experience in security operations engineering (SOC, detection engineering, IR, threat hunting, or SecOps leadership)
Expertise with SIEM/SOAR platforms
Experience with endpoint detection (EDR/XDR)
Experience with cloud logging/monitoring (GCP/AWS)
Identity security experience (Okta or similar)
Strong technical knowledge of attack techniques (MITRE ATT&CK)
Incident response workflows and forensic analysis experience
Solid background in scripting/automation (Python, Bash, or equivalent)
Ability to prioritize and execute during high-pressure incidents
Strong collaboration skills with SRE, Engineering, and GRC teams
Excellent communication and documentation skills for exec-level reporting and team enablement
Passion for threat intelligence, continuous improvement, and building scalable SecOps capabilities
Preferred: CISSP certification
Preferred: Operating SIEM and SOAR solutions
Preferred: Hands-on with cloud-native security tooling (Cloud Security Posture Management, Security Vulnerability Scanners, or Threat Intelligence Platforms)
Preferred: Familiarity with abuse monitoring, phishing detection, and takedown processes
Preferred: Experience supporting compliance efforts such as SOC2, PCI DSS, and NIST CSF
Preferred: Exposure to threat intelligence platforms, bug bounty programs, or red team collaboration
Preferred: Building dashboards and security metrics for executive visibility
Preferred: Involvement in tabletop exercises, business continuity planning, and resilience testing
Note: Visa Sponsorship is not available at this time
Benefits
Industry competitive compensation and equity plan
Paid Time Off (PTO), Paid Sick Leave (PSL) and 11 Paid Company Holidays
Full medical coverage (Extended health care, dental, vision)
Top-of-line equipment
Monthly allowance for wellness, reading and access to LinkedIn Learning for continued development
Events and activities both team-based and company wide that inspire, educate and cultivate
Applicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.