Your role and responsibilities We are looking for an experienced security engineer to join our infrastructure security engineering team with a focus on Detection and Response. You will have a unique opportunity to leverage your threat detection and response experience and build some of the foundational systems and services to keep our infrastructure free from malicious actors and threats. As an expert in your domain, you will be identifying high-leverage problems and driving open-ended projects. You will partner closely with engineering teams and compliance analysts to ensure that we maintain sufficient visibility into our environments and develop effective programs and practices to ensure that our environments are always secure. Tooling and automation will be key to success as we scale our environments to meet customer demand. In addition to being a highly productive engineer, you will serve as a technical compass and mentor the next generation of security engineers. We intend to be the world's best, fastest, and most complete stream processing service built by an excellent team, all while having fun - come join us on the journey! What You Will Do - Architect, build and maintain scalable cloud-based security monitoring solutions, across logging pipelines, ETL jobs, and SIEM ingestion. - Drive the long-term roadmap for threat hunting by translating modern adversary tradecraft (TTPs) and threat models into high-signal detection strategies to ensure our critical infrastructure operates safely. - Build processes and workflows to triage security alerts and drive incidents to closure, including participating in a shared on-call rotation for incident response. - Research new threat attack vectors and ensure that our detection and response program is in line with the current threat landscape. - Proactively improve the quality of our detection rules by defining and tracking key metrics (e.g., coverage, precision, MTTD), working directly with engineering teams to eliminate classes of issues. - Collaborate with engineering teams in building logging pipelines needed to gather relevant security telemetry, ensuring new infrastructure ships with secure-by-default visibility. - Contribute to strategy, risk management and prioritization for all efforts around detection and response. - Provide technical guidance, mentorship, and leadership to other engineers, raising the bar for security operations across the organization. Required education Bachelor's Degree Preferred education Master's Degree Required technical and professional expertise - 8+ years of relevant industry experience in detection and response or similar security engineering role in a cloud-first environment. - Deep, expert-level domain knowledge in detection engineering and security incident response. - Experience in instrumenting telemetry and building high-quality detections in large-scale, heterogeneous deployments (e.g., Kubernetes, containers, multi-cloud). - Proficient ability in writing code using Python or Golang to design complex tooling, automation, and data pipelines. - Demonstrated experience with effective incident response and containment practices, preferably in a cloud-first environment. - Experience with operating open-source and/or commercial solutions for logging and security event management (e.g. SIEM, log aggregation, SOAR, etc). - Ability to work alongside a remote team, using a data-driven mindset to propose and own engineering decisions, and the capability to drive consensus across ambiguous, organizational-wide challenges. Preferred technical and professional experience - Familiarity with more than one cloud vendor (AWS, GCP, Azure) is a plus. OTHER RELEVANT JOB DETAILS IBM offers a competitive and comprehensive benefits program. Eligible employees may have access to: - Healthcare benefits including medical & prescription drug coverage, dental, vision, and mental health & well being - Financial programs such as 401(k), cash balance pension plan, the IBM Employee Stock Purchase Plan, financial counseling, life insurance, short & long- term disability coverage, and opportunities for performance based salary incentive programs - Generous paid time off including 12 holidays, minimum 56 hours sick time, 120 hours vacation, 12 weeks parental bonding leave in accordance with IBM Policy, and other Paid Care Leave programs. IBM also offers paid family leave benefits to eligible employees where required by applicable law - Training and educational resources on our personalized, AI-driven learning platform where IBMers can grow skills and obtain industry-recognized certifications to achieve their career goals - Diverse and inclusive employee resource groups, giving & volunteer opportunities, and discounts on retail products, services & experiences We consider qualified applicants with criminal histories, consistent with applicable law. This position was posted on the date cited in the key job details section and is anticipated to remain posted for 21 days from this date or less if not needed to fill the role. IBM will not be providing visa sponsorship for this position now or in the future. Therefore, in order to be considered for this position, you must have the ability to work without a need for current or future visa sponsorship. The compensation range and benefits for this position are based on a full-time schedule for a full calendar year. The salary will vary depending on your job-related skills, experience and location. Pay increment and frequency of pay will be in accordance with employment classification and applicable laws. For part time roles, your compensation and benefits will be adjusted to reflect your hours. Benefits may be pro-rated for those who start working during the calendar year.