1 day ago
Responsibilities
- Own detection engineering end to end in Datadog Cloud SIEM, including identifying missing log sources, prioritizing onboarding, and building detection coverage.
- Write, test, tune, and manage production detection rules while reducing false positives.
- Map detections to MITRE ATT&CK and validate rules by reproducing attacker activity.
- Manage detections as code using version control, Terraform, CI pipelines, and code review.
- Build and run automation and AI agents for rule authoring, validation, coverage mapping, alert triage, and threat hunting.
- Investigate security incidents through alert triage, scoping, evidence collection, documentation, and remediation.
- Help develop automated response and containment capabilities.
- Track and communicate detection coverage, validation results, and response performance to security leadership.
Requirements
- At least 5 years of experience in security, including at least 3 years writing and owning detections in production.
- Hands-on experience with a cloud SIEM and its query language, such as Datadog Cloud SIEM, Splunk, Elastic, or Google SecOps.
- Deep knowledge of AWS logs, especially CloudTrail, IAM, and IAM Identity Center, plus experience with SaaS audit logs from platforms such as Google Workspace, GitHub, GitLab, or Okta.
- Experience managing detections as code with Terraform, Git, CI pipelines, and code review.
- Experience mapping detections to MITRE ATT&CK and testing rules by reproducing attacks with tools such as Atomic Red Team or Stratus Red Team.
- Python skills for automation, log analysis, and security tooling, with a record of shipping automation or AI agents used by others.
- Hands-on incident response experience, from investigating alerts through documenting findings and remediation.
- Ability to work independently, prioritize effectively, and own outcomes in a small team without a dedicated SOC.
- Strong written and verbal English communication skills.
- Nice-to-have experience includes CrowdStrike Falcon, Datadog SIEM, Cloudflare Zero Trust or WAF, Kubernetes/EKS audit logs, threat hunting, red team or purple team work, agentic workflows using Claude or OpenAI, fintech/payments/crypto, SOC 2 or PCI DSS, and Spanish or Portuguese.
Benefits
- Competitive salary and benefits.
- Stock options and a discretionary performance bonus.
- Latest tools and technology and a team focused on professional growth.
- Opportunity to help build a fintech app in Latin America.
- Office policy requires working in the office 3–4 days per week.
