About the RoleWe are seeking a hands-on
Security Operations & Detection Engineer to join our AI Cloud Security team on the SecOps line. Based in Los Angeles, this role focuses on real-time security alert monitoring, triage, incident response, and active detection engineering across AI Cloud's production estate-spanning GPU/AIDC infrastructure, our core cloud platform, and public-facing services.
This is a technical, hands-on operations and engineering role (not a policy or management position) working regular US Pacific daytime hours, featuring tight collaboration with our global security team.
Responsibilities- Security Monitoring & Response: Perform on-shift triage, containment, escalation, and post-incident writeups for P1/P2 security incidents across our GPU/AIDC infrastructure, cloud platform, and public services.
- SLA Adherence: Consistently meet team SLAs for critical incidents (P1 acknowledgment within $60$ 15 minutes, response start within $60$ 30 minutes).
- Detection Engineering: Continuously tune and build alert rules within our self-built SIEM, HIDS, and WAF telemetry to suppress false positives and keep paging high-signal.
- Alert-Triage Automation: Contribute to building and refining agentic triage workflows to automate routine responses and reduce noise.
- Cross-Site Collaboration: Conduct daily written and live handoffs with our Singapore security team to ensure seamless global operations across shifts.
Requirements- Experience: 3+ years of hands-on experience in a SOC, Incident Response (IR), or Detection Engineering role, with comfort acting as the primary on-shift responder.
- Infrastructure Fundamentals: Strong Linux and Kubernetes fundamentals; comfortable operating across cloud platforms and bare-metal/GPU environments.
- Query & Scripting: Practical SIEM query experience (OpenSearch, Splunk DSL, or similar) and scripting skills in Python or Go.
- Host Detection & Log Analysis: Direct experience with host-based detection tools (Falco, Wazuh, auditd), log analysis, and standard IR tooling.
- Schedule Flexibility: Willingness and ability to participate in a weekend on-call rotation.
Nice-to-Haves / Preferred Qualifications- Specialized Threat Experience: Hands-on incident response experience with crypto-mining malware or supply-chain security incidents.
- Runtime & eBPF Security: Exposure to eBPF-based detection or runtime security tools (e.g., Tetragon, Falco internals).
- AI/GPU Infrastructure: Familiarity with high-performance computing environments (NVIDIA DGX/HGX, InfiniBand, or RoCE networking).
- Languages: Professional fluency in Mandarin to facilitate day-to-day collaboration with our Singapore engineering site (English is required).
- Certifications: Industry certifications such as GCIH, GCIA, or CISSP are a plus.
