Security Operations Engineer

Security Operations Engineer Collectors Cybersecurity team is committed to utilize cybersecurity, risk and privacy best practices on our platforms, leveraging signal intelligence and observability at scale to protect our customers, employees and our brand. We're looking for a Security Operations Engineer to join our Cybersecurity team to partner with the broader Product and Tech org and drive secure by default architectures and ensure the security and integrity of our infrastructure. You'll join our Cybersecurity Team and work from our Santa Ana, CA office. Remote or hybrid candidates will also be considered. We believe that there is significant value in in-person collaboration. If you live within a 1 hour commuting distance to one of our offices, you will be required to be onsite most of the time. This will be discussed further as part of the recruiting process. What You'll Do: - Drive Detection Engineering: Build, tune and manage high-confidence detections across cloud platforms (AWS/GCP), enterprise tooling (Okta, GWS, M365) and vendor products. Treat detections as code: version controlled, peer reviewed, tested in CI, and measured for precision and coverage against MITRE ATT&CK. - Incident Command and Containment: Serve as a senior responder for security incidents, driving triage, containment, forensics, and remediation, and authoring post-incident reviews that turn lessons into durable improvements. - Threat Hunting: Conduct proactive threat hunts across cloud, SaaS, identity and on-prem infrastructure, converting hypotheses and findings into new detections and hardened controls. - Tooling and Response Automation: Design and build automation and SOAR playbooks that reduce manual toil, accelerate response times, and improve alert enrichment and case management. - Security Telemetry: Own and improve the health of the security data pipeline: log source onboarding, parser and schema quality, coverage gap analysis, and data quality for data sources across our cloud, SaaS and on-prem environment. - Automated Analysis and Secure Frameworks: Scale security efforts by integrating automation for the identification, prioritization, and remediation of vulnerabilities - Partner cross-functionally with infrastructure, platform, and engineering teams to embed security operations requirements into new services and cloud architecture decisions. - Lead by example and be a champion of all company policies, including safety, attendance & security - Participate in a shared on-call rotation, and continuously improve runbooks, escalation paths, and alert quality to make on-call sustainable for the whole team. Who You Are: - 5+ years in security operations, incident response, or detection engineering, with at least 2 years operating in a cloud-native environment at a senior level. - Deep hands-on experience securing AWS at scale (IAM, CloudTrail, GuardDuty, Security Hub, EC2/EKS/Lambda) in a multi-account organization; familiarity with GCP or Azure is a plus. - Strong SIEM proficiency - you've built and tuned detections, written complex queries, and managed log pipelines, not just consumed alerts. - Proficiency in one or more general purpose programming/script languages, preferably Python, and comfortable building automation, integrations, and SOAR playbooks from scratch. - A seasoned incident responder who stays calm under pressure, communicates clearly with technical and executive audiences, and leads without needing formal authority. - Grounded in attacker tradecraft - you think in terms of MITRE ATT&CK, understand cloud-specific attack paths, and use that lens to prioritize work. - Experienced working across team boundaries: influencing engineering roadmaps, negotiating with vendors, and representing security operations in cross-functional forums. - Pragmatic and outcome-driven - you balance ideal security posture against operational reality and know when good enough today beats perfect next quarter. - Excellent problem-solving skills, with the ability to work independently and handle multiple tasks - Familiarity with major compliance frameworks, such as PCI, NIST, ISO, SOX, and experience assisting in audits Salary Range: The salary range for this position is $140,971- $228,870. Actual compensation on this range varies based on a variety of non-discriminatory factors, including location, job level, experience, and skill set. This role may be eligible for bonuses, commissions, or other forms of compensation, please ask your recruiter for details. Reasons To Join Us: - Health Insurance: All full-time employees are eligible to enroll in Medical, Dental, and Vision - Additional Benefits:Full-time employees are eligible for fertility, commuter, and educational assistance benefits. - 401(K) Matching Plan: We are proud to offer a competitive 401k matching plan to our employees to support their future financial goals - Vacation: All salaried employees are eligible for flexible time-off. - Holiday Pay: All regular, full-time employees are eligible for ten company paid holidays - Employee Discounts: Employees receive discounts on select grading services for approved submissions - Flexible Hours: Many of our teams offer flexible schedules with varying shifts and will work with you to accommodate your needs - Fun Working Environment: Our team members are invited to participate in celebrations, holiday events, and team building activities. - Additional Resources from our technology team: Collectors Tech Blog