1 day ago
Responsibilities
- Own detection engineering and threat hunting in CrowdStrike Next-Gen SIEM across identity, email, SaaS, and endpoint telemetry.
- Build and maintain security automation that connects identity, endpoint, email, and SaaS tools for enrichment, containment, paging, ticketing, and AI-assisted response.
- Lead corporate incident response, including triage, forensics, root-cause analysis, third-party and supply-chain events, runbooks, and escalation coverage.
- Own CrowdStrike Falcon configuration and detections, the Falcon Complete relationship, device trust checks, and corporate device software and extension inventory.
- Manage Okta authentication, MFA, session policies, privileged access, user access reviews, and audit evidence automation.
- Manage Mimecast, secure network access, Google Workspace, SaaS security posture, and remediation of findings with application owners.
- Design and operate DLP across email, collaboration tools, endpoints, and SaaS applications, including data classification and exposure investigations.
- Own security for Fleetio’s AI usage, including AI tool visibility, agent identity and access, guardrails, and AI detection and response.
- Run vulnerability management for corporate assets and report security posture metrics and remediation priorities.
Requirements
- At least 5 years of experience in security operations, detection and response, or security engineering, ideally in a SaaS company.
- Experience with detection engineering and threat hunting in a SIEM, preferably CrowdStrike Next-Gen SIEM or a similar platform.
- Experience building SOAR playbooks that connect identity, endpoint, email, and SaaS tools, using Python or PowerShell and REST APIs.
- Incident response experience from triage through forensics, root cause, and follow-up across cloud, identity, and SaaS environments, including work with an MDR or managed SOC provider.
- Identity security experience with Okta or a similar provider, including authentication policy, privileged access, and access reviews in SOC 2 or ISO 27001 environments.
- Endpoint security experience with CrowdStrike or a similar platform, including macOS, device trust, and endpoint query tooling.
- Experience with Mimecast or similar email security tools and SaaS security posture management.
- Experience designing and operating DLP programs across email, cloud collaboration, and endpoints.
- Experience securing developer tooling and the software supply chain, including IDE extensions, package registries, and AI coding tools.
- Excellent written and verbal communication skills, including the ability to explain risk to non-technical leaders.
- Preferred experience with AI tool governance, agent identity and access, prompt-injection and data-exposure risks, and AI detection and response tools.
- Preferred experience building AI agents, LLM-powered automations, or security integrations using tool/function calling or MCP.
- Preferred experience using LLMs for security-alert triage, enrichment, and investigation.
Benefits
- Multiple health and dental coverage options, with 100% employee and 50% family coverage.
- Vision insurance, FSA and HSA options, short- and long-term disability coverage, and a 4% 401(k) match.
- Incentive stock options.
- Four weeks of PTO, 12 company holidays, two floating holidays, and paid parental leave.
- Community service, professional development, wellbeing, and business expense funds.
- Mac laptop and new-hire equipment stipend.
- Fully stocked kitchen with drinks and snacks at the Birmingham office.
- Remote-working-friendly arrangement.
About Fleetio
Fleetio builds cloud-based fleet management and maintenance software used by companies and public-sector fleets to track vehicles, inspections, fuel, parts, and work orders. Delivered as a subscription SaaS platform with mobile apps and telematics integrations, it centralizes asset data and workflows. Founded in 2012 and headquartered in Birmingham, Alabama, the privately held company serves fleets of all sizes in more than 80 countries and manages hundreds of thousands of assets.