2 months ago
Base Salary
$265k - $310k/yr
Responsibilities
- Own the design and evolution of Envoy’s threat detection and security operations capabilities.
- Define detection strategy across cloud infrastructure, applications, and endpoints.
- Establish and improve SIEM and monitoring architecture, including signal quality, coverage, and scalability.
- Design and implement detection-as-code standards and practices.
- Ensure endpoints, services, and identities have consistent monitoring coverage.
- Own endpoint security monitoring, including SentinelOne integration into centralized detection workflows.
- Lead automated security control rollouts, including secrets rotation for high-risk systems.
- Define alerting severity models, escalation paths, and on-call expectations.
- Lead investigations into complex or ambiguous security signals and establish root cause analysis standards.
- Partner with engineering teams to improve instrumentation and security signal quality.
- Define and track MTTD and MTTR metrics and drive measurable improvements.
- Mentor and guide engineers in detection and security operations.
Requirements
- 6+ years of experience in Security Engineering, SRE, or Infrastructure Engineering with a strong security focus.
- Experience designing or significantly improving security monitoring, detection, or SIEM systems.
- Strong understanding of cloud environments, ideally AWS, including IAM, networking, and logging at scale.
- Experience with endpoint detection and response tools such as SentinelOne or similar.
- Deep experience using logs, events, and telemetry to build high-signal detections.
- Strong programming or scripting skills in Python, Go, or similar, focused on automation and system design.
- Strong understanding of attacker behavior and translating threats into detection strategies.
- Experience defining alerting models and reducing noise while maintaining coverage.
- Ability to operate in ambiguous environments and establish structure.
- Strong cross-functional communication and ability to influence engineering and leadership.
- Pragmatic, outcome-oriented approach focused on reducing risk and improving operational effectiveness.
Benefits
- On-site role requiring four days per week, Monday through Thursday, at the San Francisco headquarters.