Description

You will own security operations, detection engineering, and incident response for cloud and SaaS environments.

Responsibilities

• Monitor, triage, and investigate security alerts across SIEM, EDR, and cloud-native detection platforms.
• Develop and tune detection rules for cloud, endpoint, SaaS, and AI agent behavioral anomalies.
• Operate SSPM and CSPM tooling to identify and mitigate cloud misconfigurations and vulnerabilities.
• Own the end-to-end incident response process, including containment, forensics, and post-incident reviews.
• Author and maintain incident response playbooks for scenarios including ransomware and AI-specific attacks.

Required Skills

• 5+ years of experience in information security with meaningful time in security operations and incident response.
• Hands-on SIEM experience (Microsoft Sentinel or Splunk) including detection rule authorship.
• Demonstrated incident response experience — ability to describe running an actual incident end-to-end.
• Experience with EDR platforms (CrowdStrike, SentinelOne, or equivalent).
• Working knowledge of AWS or Azure cloud security (IAM, logging, network security groups).
• Familiarity with NYDFS 23 NYCRR 500 or equivalent regulated-industry IR notification requirements.
• MITRE ATT&CK framework fluency — mapping real incidents to TTPs.
• Strong written communication for incident reports and regulatory notifications.

Preferred Skills

• Experience with AI/LLM security monitoring and OWASP LLM Top 10 familiarity.
• Digital forensics experience (memory analysis, disk imaging, log preservation).

Key Skills

Education

Bachelor's degree