Staff Security Engineer, Cloud Detection & Response

Aurora is building stronger security detection and response capabilities across cloud and enterprise environments, and this Staff Security Engineer role sits at the center of that effort. You will help mature detection infrastructure, improve telemetry ingestion and normalization, and expand detection-as-code workflows that scale with testing, versioning, and CI/CD. Based in Dallas, TX, this position involves cross-functional delivery spanning detection engineering, threat intelligence integration, incident response, and collaboration with the SOC.

Location: Dallas, TX (onsite)

Salary: USD 171,000 - 303,000 per year

Experience: 10+ years

What you will do

• Lead multi-quarter, cross-functional initiatives to mature Aurora’s detection infrastructure, including log ingestion and normalization, detection-as-code pipelines with testing, versioning, and CI/CD for detection content, and scalable cost-aware telemetry collection.
• Increase detection coverage across cloud and corporate environments by prioritizing and delivering coverage improvements.
• Design, build, and tune detections for cloud control plane and workload activity, identity-based attacks, endpoint, SaaS threats, abuse of CI/CD, and service-to-service communication paths.
• Partner with Cloud Infrastructure, IT, and Platform Engineering to embed logging and detection requirements into system design, and represent Detection & Response in cross-functional working groups and design reviews.
• Integrate threat intelligence and adversary emulation into detection coverage priorities, and run proactive threat hunting across cloud, identity, endpoint, and SaaS data.
• Respond to cloud and enterprise security incidents and participate in an on-call rotation, then feed lessons learned back into detection coverage and infrastructure improvements.
• Collaborate with and mentor SOC engineers on cloud and enterprise detection practices, and contribute to quarterly planning for detection infrastructure and coverage initiatives.

What you bring

• 10+ years of security experience, including demonstrated experience leading cross-functional security projects or programs from scoping through delivery.
• Strong technical foundation in threat detection and incident response.
• Expertise in cloud security across one or more major providers, including cloud-native telemetry and detection sources.
• Experience building or maturing detection infrastructure, including SIEM or security data lake pipelines, log onboarding and normalization, and detection-as-code workflows.
• Expertise with EDR and SaaS security monitoring, or comparable depth in host and application telemetry.
• Experience authoring and maintaining detections (anomalous, network, host, identity, or cloud activity) and measuring detection coverage against adversary behavior.
• Experience with incident management and driving cross-departmental collaboration for containment and remediation.
• Expertise with MITRE ATT&CK and modern adversarial techniques, along with understanding of NIST CSF.
• Ability to write quality, testable code in Python.

Technologies: Python, MITRE ATT&CK, NIST CSF, SIEM, detection-as-code, CI/CD, EDR

Desirable qualifications

• Experience designing and implementing Zero Trust Architecture.
• Experience scaling SOC and Detection Engineering with AI/LLM.
• Experience building and architecting data lakes.
• Experience with compliance frameworks (SOC 2, ISO 27001).

Additional location-based salary details

• For roles based in Mountain View: $189,000 - $303,000 per year.
• For roles based in Pittsburgh, PA: $171,000 - $273,000 per year.

Compensation and workplace expectations

• Aurora’s pay ranges are determined by role, level, and location. Starting base pay within the range depends on job-related skills, experience, qualifications, relevant education or training, and market conditions.
• Ranges may be modified in the future.
• The successful candidate will also be eligible for an annual bonus, equity compensation, and benefits.
• Aurorans are expected to work from the office at least 3 days per week, with some roles requiring more frequent in-office presence, up to 5 days per week, based on operational needs.