Security Operations Engineer II

Description

The company runs a security operations center that watches over its corporate, cloud, and regulated SaaS environments, which serve public safety agencies and businesses worldwide.

As a Security Operations Engineer II you come in as an engineer first. You will handle alerts, triage incidents, and take part in the on-call rotation, then use that daily experience to automate the repetitive work that slows response. You will build playbooks, tool integrations, and detections, and lead incidents from first signs through root cause and fix, feeding each lesson back into better detections. As automation absorbs routine tasks, more of your time goes to capabilities that let the SOC grow with the company.

Responsibilities

• Build and run security automation with version control, code review, testing, and CI/CD, covering playbooks, chat-based workflows, and services that link security tools.
• Connect security, identity, IT service management, and cloud platforms through their APIs, handling authentication and secrets safely.
• Manage the detection lifecycle: add new log sources, write and tune detections, spot coverage gaps, and keep detections as code.
• Deploy and maintain the cloud infrastructure under security tools using infrastructure-as-code and least-privilege access.
• Build detections and automation that satisfy strict data-handling and compliance rules.
• Turn incident lessons into reusable playbooks, templates, and tooling so response stays consistent across the team.
• Assess new security tools, including automation platforms and AI-assisted triage, for fit, security, and licensing, and move the selected ones into production.
• Track team workload and the time automation saves, and report metrics that show where to invest next.
• Work with senior engineers on platform design and help more junior colleagues with scripting and automation.

Requirements

• 2+ years in security engineering, SOC or detection engineering, or software or infrastructure roles with a security focus.
• Strong Python, shell scripting, and Git skills, with experience shipping and maintaining production code.
• Hands-on incident response and alert triage, and willingness to join an on-call rotation.
• You have used a SIEM, a log analytics tool, or a SOAR or workflow automation product.
• Working knowledge of cloud platforms, identity providers, EDR, REST APIs, and authentication.
• Hands-on work with infrastructure-as-code tooling.
• Experience with Git teamwork, including branches, pull requests, and code review.
• Experience building and maintaining production CI/CD pipelines.
• Understanding of the software development lifecycle and application design, and a habit of writing maintainable, tested code.
• Familiarity with secure development practices such as dependency scanning, secrets scanning, and handling secrets in pipelines.
• Clear written communication for runbooks, incident timelines, and audit evidence.

Conditions

You report to the Manager, Information Security Engineering. This role has no direct reports.

Day to day, you handle security alerts, tickets, and user-reported phishing through the team's shared queue rotation.

On call, you investigate, contain, and coordinate escalated events such as exposed credentials, data spillage, suspicious account activity, and cloud account compromise.

You own each incident to closure, including the timeline, root cause, remediation tracking, and a detection or playbook update.

You find repetitive manual work and automate it, for example phishing triage and enrichment, offboarding checks, vulnerability remediation tracking, and bulk ticket handling.

You write, tune, and document detections, retire noisy alerts, and write a runbook for each alert you ship.

You support identity and access work, including offboarding, access requests, and access reviews, and automate the checks that keep them reliable.

You produce audit and compliance evidence and automate its collection where possible.

Base pay range is $96,000 - $153,600 USD. Total compensation is base pay, bonus, and stock awards. Actual base pay depends on level, function, training, transferable skills, work experience, business needs, geographic market, or a mix of these.

Some roles may require legal eligibility to work in a firearms environment.

You must follow environmental, health, and safety rules and policies and report concerns as they arise.

The company is an equal opportunity employer and hires regardless of race, sex, age, citizenship status, disability, veteran status, and other protected characteristics.

This description does not list every duty, and it may change as business needs change.

Benefits

• Competitive salary, plus a 401k with employer match.
• Discretionary paid time off.
• Paid parental leave for all employees.
• Medical, dental, and vision plans.
• Fitness programs.
• Emotional and mental wellness support.
• Learning and development programs.
• Employee resource groups.
• Snacks in the offices.
• Benefits may vary depending on the type of employment and the location where you work.