Staff Security Engineer, Cloud Detection & Response

Job description

Job responsibilities

• Drive cross-functional projects to mature Aurora's detection infrastructure, log ingestion and normalization, detection-as-code pipelines with testing, versioning, and CI/CD for detection content, and scalable,…
• Expand detection coverage across cloud and corporate environments and prioritize coverage improvements
• Design, build, and tune detections for cloud control plane and workload activity, identity-based attacks, endpoint, SaaS threats, abuse of CI/CD and service-to-service communication paths
• Partner with Cloud Infrastructure, IT, and Platform Engineering to embed logging and detection requirements into system design, and represent D&R in cross-functional working groups and design reviews
• Integrate threat intelligence and adversary emulation into detection coverage priorities, and conduct proactive threat hunting across cloud, identity, endpoint, and SaaS data
• Respond to cloud and enterprise security incidents and participate in an on-call rotation, feeding lessons learned back into detection coverage and infrastructure improvements
• Collaborate with and mentor SOC engineers on cloud and enterprise detection practices, and contribute to quarterly planning for detection infrastructure and coverage initiatives

Job requirements

• 10+ years of security experience; demonstrated experience leading cross-functional security projects or programs from scoping through delivery
• Strong technical foundation in threat detection, incident response
• Expertise with cloud security across one or more major providers, including cloud-native telemetry and detection sources
• Experience building or maturing detection infrastructure - SIEM or security data lake pipelines, log onboarding and normalization, detection-as-code workflows
• Expertise with endpoint detection and response (EDR) and SaaS security monitoring, or comparable host and application telemetry depth
• Expertise authoring and maintaining detections (anomalous, network, host, identity, or cloud activity) and measuring detection coverage against adversary behavior
• Experience with incident management, driving cross-departmental collaboration for containment and remediation
• Expertise with MITRE ATT&CK framework and modern adversarial techniques; understanding of NIST CSF