🕒 2 days ago
Leads the bank’s cyber resilience testing and offensive security program, planning red-team exercises and threat simulations while assessing security controls and communicating technical findings to stakeholders.
Staff Security Engineer, Security Operations
🕒 yesterday
AWS SecurityCloudtrailGuarddutySecurity Hub
📜 Description
- Design, test, and tune detections across cloud, identity, endpoint, and email telemetry using detection-as-code and MITRE ATT&CK.
- Manage security logging, SIEM, alerting pipelines, and monitoring of enterprise AI tools, agents, integrations, and API keys.
- Lead security incident investigation, containment, eradication, and recovery; maintain response plans, playbooks, and runbooks.
- Deploy and manage security operations tools, including cloud monitoring, WAF, DDoS protection, IDS, CrowdStrike EDR, and email security.
- Build AI agents and automation for alert triage, enrichment, investigation, and response.
- Assess vulnerabilities and security technologies, advise on AWS system design, and mentor security and engineering teams.
🛠️ Requirements
- In-depth AWS security knowledge, including configuration, logging, CloudTrail, GuardDuty, and Security Hub.
- Hands-on detection engineering experience with SIEM query languages and detection-as-code.
- Incident response experience, including log analysis and host and cloud investigation.
- Familiarity with MITRE ATT&CK, OWASP Top 10, and network and web protocols such as TCP/IP, DNS, HTTP, HTTPS, and TLS.
- Experience with or ability to quickly learn EDR platforms and email security; CrowdStrike Falcon preferred.
- Experience building automation in Python or a similar language and building or integrating LLM-based agents and workflows.
- Understanding of AI risks, including prompt injection, data leakage, and excessive agent permissions.
- Experience in a SOC 2, PCI-DSS, or ISO control environment; relevant security certifications are a plus.
Full job description
About GoodLeap:
GoodLeap is a technology company delivering best-in-class financing and software products for sustainable solutions, from solar panels and batteries to energy-efficient HVAC, heat pumps, roofing, windows, and more. Over 1 million homeowners have benefited from our simple, fast, and frictionless technology that makes the adoption of these products more affordable, accessible, and easier to understand. Thousands of professionals deploying home efficiency and solar solutions rely on GoodLeap’s proprietary, AI-powered applications and developer tools to drive more transparent customer communication, deeper business intelligence, and streamlined payment and operations. Our platform has led to more than $30 billion in financing for sustainable solutions since 2018.
GoodLeap is also proud to support our award-winning nonprofit, GivePower, which is building and deploying life-saving water and clean electricity systems, changing the lives of more than 1.6 million people across Africa, Asia, and South America.
Position Summary
The Staff Security Engineer, Security Operations is responsible for protecting GoodLeap’s cloud environments, applications, endpoints, and corporate systems through detection engineering, incident response, and security operations. This role builds and tunes detections, leads investigation and response for security incidents, and manages the security tooling that provides visibility across cloud, identity, endpoint, and email. The Staff Security Engineer will design and build AI agents and automation that reduce time-to-detect and time-to-respond, and will establish monitoring of AI activity across the enterprise, including AI tools, agents, and integrations used by employees and engineering teams. This role works closely with software engineers, infrastructure, IT, and compliance partners to ensure security controls are consistently applied and operationally effective.
Additionally, the Staff Security Engineer develops security requirements, conducts security risk assessments, evaluates security services and technologies, maintains incident response plans and runbooks, and provides mentoring to the security team and partner engineering teams. This role will own endpoint detection and response (CrowdStrike) and email security as these capabilities are brought into the security function.
Essential Job Duties and Responsibilities
Detection Engineering & Monitoring
Incident Response
- Lead investigation, containment, eradication, and recovery for security incidents.
- Serve as incident lead for significant events and coordinate with legal, compliance, and leadership on regulatory notification obligations.
- Maintain incident response plans, playbooks, and runbooks.
- Conduct tabletop exercises and post-incident reviews that drive lasting control improvements.
- Deploy and manage the security operations toolset, including cloud security monitoring, WAF, DDoS protection, IDS, EDR (CrowdStrike), and email security.
- Build AI agents and automation for alert triage, enrichment, investigation, and response.
- Review results from vulnerability scans, penetration testing, and other sources for true positives and propose remediation or mitigating controls.
- Serve as a subject matter expert (SME) on AWS cloud security and consult on the secure design of cloud-based systems.
- Provide mentorship and guidance to the security team and partner engineering teams on detection, response, and security operations practices.
- Share in-depth understanding of company and industry methodologies, policies, standards, and controls.
- Help build the security team and lead efforts to mature GoodLeap’s security operations capability.
Security Tooling, Automation & AI Agents
Mentorship & Leadership
Required Skills, Knowledge and Abilities
- In-depth knowledge of Amazon AWS, including security configuration, logging, and tooling (e.g., CloudTrail, GuardDuty, Security Hub).
- Hands-on experience in detection engineering, including SIEM query languages and detection-as-code.
- Hands-on experience in incident response, including log analysis and host and cloud investigation.
- Familiar with the MITRE ATT&CK framework and OWASP Top 10.
- Knowledge of network and web related protocols (e.g., TCP/IP, DNS, HTTP, HTTPS, TLS).
- Experience with, or ability to quickly ramp on, EDR platforms (CrowdStrike Falcon preferred).
- Experience with, or ability to quickly ramp on, email security (phishing, BEC, DMARC/SPF/DKIM).
- Experience building automation in Python or a similar language.
- Experience building or integrating LLM-based agents and workflows.
- Understanding of AI-specific risks such as prompt injection, data leakage, and excessive agent permissions.
- Experience working in a SOC 2, PCI-DSS, or ISO control environment.
- Proven ability to combine business acumen, technical acumen, and process expertise to assess requirements and alignment.
- Strong communicator across verbal, written, ticketing, and messaging channels.
- Able to prioritize and deliver on multiple tasks independently with a strong bias toward action in a fast-paced environment.
- GCIH, GCFA, GCDA, CCSP, CISSP, CrowdStrike, or comparable certifications are a plus.
Similar jobs
Search more Cybersecurity Engineer jobs
Principal Security Engineer, Security Tribe
🕒 14 days ago
Agilityrobotics👥 10,000+ employees🏢 Computer Software
🕒 14 days ago
The Principal Security Engineer will shape HelloFresh's security strategy, influencing technical decisions and ensuring security is integrated into all aspects of the company's operations.
🕒 15 days ago
As a Cyber Security Engineering Tech Lead, you will design and implement security architectures, manage enterprise security technologies, and lead security projects across teams.
🕒 16 days ago
Design and build security systems that integrate seamlessly into infrastructure, focusing on identity management, cloud security, and automated processes to enhance security operations.
🕒 17 days ago
Lead the development and design of application-level security controls, perform security reviews, and enable automated security testing in a fast-paced DevSecOps environment.