Staff Security Engineer, Security Operations
West Palm Beach, FLAll locationsWest Palm Beach, FLRoseville, CA - HQSan Francisco, CAAustin, TXSeattle, WARemote, USNew York Hybrid
$167,400–$212,500 a yearJobFig found this opening at its original source and checks that it remains available.
About the role
The Staff Security Engineer, Security Operations is responsible for protecting GoodLeap’s cloud environments, applications, endpoints, and corporate systems through detection engineering, incident response, and security operations. This role builds and tunes detections, leads investigation and response for security incidents, and manages the security tooling that provides visibility across cloud, identity, endpoint, and email. The Staff Security Engineer will design and build AI agents and automation that reduce time-to-detect and time-to-respond, and will establish monitoring of AI activity across the enterprise, including AI tools, agents, and integrations used by employees and engineering teams. This role works closely with software engineers, infrastructure, IT, and compliance partners to ensure security controls are consistently applied and operationally effective. Additionally, the Staff Security Engineer develops security requirements, conducts security risk assessments, evaluates security services and technologies, maintains incident response plans and runbooks, and provides mentoring to the security team and partner engineering teams. This role will own endpoint detection and response (CrowdStrike) and email security as these capabilities are brought into the security function.
What you'll bring
- Required Skills, Knowledge and Abilities
- In-depth knowledge of Amazon AWS, including security configuration, logging, and tooling (e.g., CloudTrail, GuardDuty, Security Hub).
- Hands-on experience in detection engineering, including SIEM query languages and detection-as-code.
- Hands-on experience in incident response, including log analysis and host and cloud investigation.
- Familiar with the MITRE ATT&CK framework and OWASP Top 10.
- Knowledge of network and web related protocols (e.g., TCP/IP, DNS, HTTP, HTTPS, TLS).
- Experience with, or ability to quickly ramp on, EDR platforms.
- Experience with, or ability to quickly ramp on, email security (phishing, BEC, DMARC/SPF/DKIM).
- Experience building automation in Python or a similar language.
- Experience building or integrating LLM-based agents and workflows.
- Understanding of AI-specific risks such as prompt injection, data leakage, and excessive agent permissions.
- Experience working in a SOC 2, PCI-DSS, or ISO control environment.