Senior CSIRT Engineer

Vultr

Senior CSIRT Engineer managing and optimizing SIEM and EDR platforms for Vultr's security team. Collaborating with analysts to investigate security events and enhance incident response capabilities.

Posted 7/9/2026full-timeRemote • 🇺🇸 United StatesSeniorWebsite

Tech Stack

Tools & technologies

LinuxMacOSPython

About the role

Key responsibilities & impact

Engineer, tune, and maintain detection rules and analytics in the SIEM and EDR platforms
Administer SIEM platform health, parser configuration, log source onboarding, and data pipeline optimization.
Design and build SOAR playbooks and automated response workflows to streamline triage, enrichment, and containment.
Develop and maintain integrations between security tools (SIEM, EDR, SOAR, SEG, TIP, DLP, ticketing)
Map detection coverage to MITRE ATT&CK to identify and close gaps
Identify and drive improvements to security visibility across the environment, including new log sources, enrichment opportunities, and telemetry gaps
Assist with investigation of security events, from alert through remediation
Assist with conducting threat hunts across organizational telemetry
Assist incident response with log analysis, artifact collection, and containment
Manage EDR platform coverage, sensor health, and policy configuration
Coordinate with Threat Intelligence to translate intel into deployed, actionable detection logic
Coordinate with Security Engineering on infrastructure integrations and log pipeline architecture
Document detection logic, automation workflows, and operational procedures

Requirements

What you’ll need

Minimum of 5 years experience in detection engineering, SIEM engineering, SOAR engineering, Security Operations, or a closely related role
Hands-on SIEM experience at an engineering level: rule authoring, parser development, log source integration, platform administration.
Experience building SOAR workflows and automated response playbooks.
Experience with EDR platforms, including policy configuration, telemetry analysis, and live response.
Demonstrated proficiency in PowerShell, Bash, Python, common Query Languages (FQL, KQL, EQL, LEQL, MQL, etc) and YARA, SIGMA, and CAPA rules.
Experience conducting security investigations, threat hunting, and incident response
Solid understanding of attack techniques and detection logic mapped to MITRE ATT&CK
Proficiency with Linux, MacOS, and Windows.

Benefits

Comp & perks

Excellent Medical Benefits w/ 100% company-paid premiums for employee only plan + 100% company-paid dental & vision premiums
401(k) plan that matches 100% up to 4% with immediate vesting
Professional Development Reimbursement of $2,500 each year
11 Holidays + Paid Time Off Accrual + Rollover Plan + take your birthday off
Commitment matters to Vultr! Increased PTO at 3 year & 10 year anniversary + 1 month paid sabbatical every 5 years + Anniversary Bonus each year
$500 first year remote office setup + $400 each following year for new equipment
Internet reimbursement up to $75 per month
Gym membership reimbursement up to $50 per month
Company-paid Wellable subscription

ATS Keywords

✓ Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills & Tools

SIEM AdministrationSOAR Playbook DevelopmentEDR Policy ConfigurationPowerShellBashPythonFQLKQLYARASIGMA