Staff Security Engineer, Security Operations

The Staff Security Engineer, Security Operations role at GoodLeap focuses on protecting cloud environments, applications, endpoints, and corporate systems through detection engineering, incident response, and security operations. The position is responsible for building and tuning detection coverage, leading investigations, and expanding automation, including AI agent capabilities, to improve time-to-detect and time-to-respond.

Responsibilities

• Design, build, test, and tune detections across cloud, identity, endpoint, and email telemetry using detection-as-code practices aligned to MITRE ATT&CK.
• Manage security logging, SIEM, and alerting pipelines to support detection and monitoring workflows.
• Establish monitoring for AI activity, including AI tools, agents, MCP integrations, and API keys, with focus on detecting data exposure, misuse, and anomalous behavior.
• Decrease time-to-detect by applying threat intelligence and sensor enrichment.
• Lead end-to-end incident activity including investigation, containment, eradication, and recovery.
• Act as incident lead for significant events and coordinate with legal, compliance, and leadership on regulatory notification obligations.
• Maintain incident response plans, playbooks, and runbooks.
• Conduct tabletop exercises and post-incident reviews to drive lasting control improvements.
• Deploy and operate the security operations toolset, including cloud security monitoring, WAF, DDoS protection, IDS, EDR (CrowdStrike), and email security.
• Build AI agents and automation for alert triage, enrichment, investigation, and response.
• Review vulnerability scan results, penetration testing outputs, and other security sources to identify true positives and propose remediation or mitigating controls.
• Serve as an SME for AWS cloud security and consult on secure design for cloud-based systems.
• Mentor the security team and partner engineering teams on detection, response, and security operations practices.
• Share knowledge of company and industry methodologies, policies, standards, and controls.
• Support security team growth and lead efforts to mature GoodLeap’s security operations capability.
• Develop security requirements, conduct security risk assessments, evaluate security services and technologies, maintain incident response planning, and provide mentoring across the security organization and partner engineering teams.
• Own endpoint detection and response (CrowdStrike) and email security as capabilities are brought into the security function.

Requirements

• In-depth knowledge of Amazon AWS, including security configuration, logging, and related tooling such as CloudTrail, GuardDuty, and Security Hub.
• Hands-on detection engineering experience, including SIEM query languages and detection-as-code.
• Hands-on incident response experience, including log analysis and host and cloud investigation.
• Familiarity with MITRE ATT&CK and OWASP Top 10.
• Knowledge of network and web protocols including TCP/IP, DNS, HTTP, HTTPS, and TLS.
• Experience with, or ability to quickly ramp on, EDR platforms (preferred: CrowdStrike Falcon).
• Experience with, or ability to quickly ramp on, email security covering phishing, BEC, and DMARC/SPF/DKIM.
• Experience building automation in Python or a similar language.
• Experience building or integrating LLM-based agents and workflows.
• Understanding of AI-specific risks including prompt injection, data leakage, and excessive agent permissions.
• Experience working in SOC 2, PCI-DSS, or ISO control environments.
• Proven ability to apply business, technical, and process expertise to assess requirements and alignment.
• Strong communication skills across verbal, written, ticketing, and messaging channels.
• Ability to prioritize and deliver independently across multiple tasks in a fast-paced environment.
• GCIH, GCFA, GCDA, CCSP, CISSP, CrowdStrike, or comparable certifications are a plus.

Technologies

• Amazon AWS, CloudTrail, GuardDuty, Security Hub
• MITRE ATT&CK, OWASP Top 10
• SIEM
• CrowdStrike Falcon, CrowdStrike, EDR
• WAF, DDoS protection, IDS
• TCP/IP, DNS, HTTP, HTTPS, TLS
• Python
• LLM-based agents, MCP integrations, API keys
• DMARC, SPF, DKIM
• SOC 2, PCI-DSS, ISO

Location

Remote (remote)

Compensation

Salary: USD 167,400 - 212,500 per year

• Base pay range (CA, WA, NJ, MA, DC, NYC): $184,100 - $212,500 per year
• Base pay range (all other US locations): $167,400 - $193,200 per year

In addition to the above salary, this role may be eligible for a bonus and equity.