4 months ago
Base Salary
$265k - $300k/yr
Responsibilities
- Own and evolve Envoy’s threat detection and security operations capabilities.
- Define detection strategy across cloud infrastructure, applications, and endpoints.
- Establish and improve SIEM and monitoring architecture, including signal quality, coverage, and scalability.
- Design and implement detection-as-code practices and standards.
- Drive visibility and monitoring across critical endpoints, services, and identities.
- Own endpoint security monitoring, including SentinelOne integration into centralized detection workflows.
- Lead automated security controls such as secrets rotation for high-risk systems.
- Define alerting severity models, escalation paths, and on-call expectations.
- Lead investigations into complex or ambiguous security signals and set root cause analysis and response standards.
- Partner with engineering teams to improve instrumentation and security signal quality.
- Define and track MTTD and MTTR metrics and drive measurable improvements.
- Mentor and guide engineers in detection and security operations.
Requirements
- 10+ years of experience in Security Engineering, SRE, or Infrastructure Engineering with a strong security focus.
- Proven experience designing or significantly improving security monitoring, detection, or SIEM systems.
- Strong understanding of cloud environments, ideally AWS, including IAM, networking, and logging at scale.
- Experience with endpoint detection and response tools such as SentinelOne or similar.
- Deep experience using logs, events, and telemetry to build high-signal detections.
- Strong programming or scripting skills in Python, Go, or similar, focused on automation and system design.
- Strong understanding of attacker behavior and translating threats into detection strategies.
- Experience defining alerting models and reducing noise while maintaining coverage.
- Ability to operate in ambiguous environments and define structure.
- Strong cross-functional communication and ability to influence engineering and leadership.
- Pragmatic, outcome-oriented approach focused on reducing risk and improving operational effectiveness.
Benefits
- This is an on-site position requiring four days per week, Monday through Thursday, at Envoy’s San Francisco headquarters.
- The role is an L5 opportunity, typically suited to staff- or principal-level candidates who establish technical direction and lead large-scale initiatives.