Senior Information Security Engineer – Detection, Automation, AI

Zoox

Senior Information Security Engineer designing SIEM detections and SOAR automation for Zoox’s autonomous vehicle platform. Integrating Python, AWS, and LLMs into incident response and alert triage.

Posted 8/5/2026full-timeFoster City • California • 🇺🇸 United StatesSenior💰 $190,000 - $228,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in Information Security and Security Operations, with a strong focus on developing and maintaining detection logic within SIEM platforms and automating security workflows. Proficient in Python scripting, AWS security services, and incident response methodologies.

Highest-signal resume keywords

Information Security ExperiencePython ScriptingSIEM Log AnalysisAutomated SOAR PlaybooksAWS Security Services

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection Logic DesignIncident ResponseAPI AutomationInfrastructure as CodeLog AnalysisAlert TuningPost-Incident ReviewLLM API IntegrationSecurity Tool DevelopmentAutomated Prevention

Soft Skills

Analytical ThinkingProblem SolvingCollaboration

Tools & Technologies

SplunkElasticSIEMSOAR PlatformsTerraformAWSGuardDutyCloudTrailIAMVPC Flow Logs

Certifications & Qualifications

CISSPGCIAGCIHAWS Certified Security – Specialty

Industry Keywords

MITRE ATT&CK FrameworkNIST SP 800-61SANS PICERLSecurity OperationsDevSecOps

Tech Stack

Tools & technologies

AWSPythonSplunkTerraform

About the role

Key responsibilities & impact

Design, build, test, and maintain high-fidelity detection logic within the SIEM platform
Map detections to the MITRE ATT&CK framework
Tune alerts to minimize false positives and reduce alert fatigue
Architect and implement automated SOAR playbooks to reduce MTTR
Develop Python scripts, tools, and REST API integrations for security tools and data sources
Manage infrastructure and configuration as code
Design LLM-enabled workflows to analyze, summarize, and contextualize security alerts
Build prompt engineering pipelines or agentic workflows to assist analysts during investigations
Serve as a senior escalation point for security incidents through containment, eradication, and recovery
Monitor and secure AWS and on-premise workloads
Conduct post-incident reviews and develop automated preventions and detections

Requirements

What you’ll need

8+ years of dedicated experience in Information Security, Security Operations, or DevSecOps engineering roles
Hands-on experience with Splunk or ElasticSIEM for log analysis and detection creation
Strong proficiency in Python and experience building security tools, scripts, and API automation pipelines
Experience designing and maintaining automated playbooks in a modern SOAR platform
Experience or advanced personal projects using LLM APIs for security logs or triage workflows
Understanding of AWS security services including GuardDuty, CloudTrail, IAM, and VPC Flow Logs
Familiarity with Incident Response lifecycles such as NIST SP 800-61 and SANS PICERL
Certification such as CISSP, GCIA, GCIH, or AWS Certified Security – Specialty is a bonus
Experience with Infrastructure as Code tools such as Terraform is a bonus
Contributions to the open-source security community are a bonus

Benefits

Comp & perks

Paid time off, including sick leave, vacation, and bereavement
Unpaid time off
Zoox Stock Appreciation Rights
Amazon Restricted Stock Units (RSUs)
Health insurance
Long-term care insurance
Long-term and short-term disability insurance
Life insurance
Potential sign-on bonus