9 days ago
Responsibilities
- Own detection engineering end to end in Datadog Cloud SIEM, including identifying missing log sources, prioritizing onboarding, and building detection coverage.
- Write, test, and tune detection rules while reducing false positives and preserving meaningful threat visibility.
- Map detections to MITRE ATT&CK and validate them by reproducing attacker activity.
- Manage detections as code through version control, CI pipelines, and code review.
- Build and run automation and AI agents for rule authoring, detection validation, coverage mapping, alert triage, and threat hunting.
- Investigate security incidents through alert triage, scoping, evidence collection, documentation, and remediation.
- Help develop automated response and containment capabilities.
- Track and communicate detection coverage, validation results, and response performance to security leadership.
Requirements
- 5+ years of experience in security, including 3+ years writing and owning detections in production.
- Hands-on experience with a cloud SIEM and its query language, such as Datadog Cloud SIEM, Splunk, Elastic, or Google SecOps.
- Deep knowledge of AWS logs, particularly CloudTrail, IAM, and IAM Identity Center, plus SaaS audit logs from platforms such as Google Workspace, GitHub, GitLab, or Okta.
- Experience managing detections as code with Terraform, Git, CI pipelines, and code review.
- Experience mapping detections to MITRE ATT&CK and testing rules by reproducing attacks with tools such as Atomic Red Team or Stratus Red Team.
- Python skills for automation, log analysis, and security tooling, with a record of shipping automation or AI agents used by others.
- Hands-on incident response experience, from investigating alerts through documenting findings and remediation.
- Ability to work independently, prioritize effectively, and own outcomes in a small team without a dedicated SOC.
- Strong written and verbal communication in English.
- Preferred qualifications include familiarity with CrowdStrike Falcon, Datadog SIEM, Cloudflare Zero Trust, or WAF; Kubernetes EKS audit logs; threat hunting, red team, or purple team experience; agentic workflows using Claude or OpenAI; fintech, payments, or crypto experience with SOC 2 or PCI DSS exposure; and Spanish or Portuguese language skills.
Benefits
- Competitive salary and benefits.
- Stock options and a discretionary performance bonus.
- Latest tools and technology and an opportunity to grow with a world-class team.
- Opportunity to help build a fintech app in Latin America.
- Office policy requires working in the office 3–4 days per week.
