Security Engineer III

As a Security Engineer in Security Operations, you design and enhance the platform’s security capabilities to detect, investigate, and respond to threats. You operate at the intersection of engineering and operations, turning security problems into scalable, automated solutions. You’ll work with cross-functional teams to refine detections, triage alerts, and improve incident response. This role offers hands-on work with modern security tooling to strengthen our AI-enhanced platform and protect global customers. You’ll contribute to a culture of excellence and impact through proactive security engineering and threat intelligence.

• Investigate and triage security alerts from diverse sources (logs, endpoints, identity, cloud, network) to determine impact and root cause.
• Escalate and resolve confirmed threats with the wider SOC; document findings and feed learnings back into detections, tuning, and automation.
• Support security incidents with DFIR practices across endpoints, cloud, and identity data; assist in evidence collection, timeline reconstruction, and post-incident reviews.
• Contribute to SIEM engineering: onboarding and normalising log sources, building parsers, maintaining data pipelines, and improving coverage and performance.
• Develop and maintain a library of detections using Detection as Code; map detections to MITRE ATT&CK; contribute to coverage, precision, and evasion resistance.
• Explore and apply AI/ML to enhance security operations, including alert triage, threat intelligence analysis, and tooling evaluation.
• Integrate threat intelligence feeds into detection logic, response playbooks, and hunting activities.
• Participate in proactive threat hunting to identify attacker activity and feed findings back into tooling and detections.

• Technical security experience in a security operations role.
• Hands-on incident response and digital forensics experience.
• Experience developing and tuning SIEM detections and threat hunting queries.
• Hands-on knowledge of SecOps tooling: SIEM, EDR/XDR, vulnerability scanners, ticketing/case systems.
• Experience with threat intelligence platforms and integrating intelligence into tooling and processes.
• Proficiency in scripting/programming languages (e.g., Python, Go, Bash).
• Familiarity with secure development practices, OWASP top risks, and code remediation collaboration.
• Knowledge of security frameworks and standards (NIST CSF, CIS Benchmarks, MITRE ATT&CK; SOC 2/ISO 27001).
• Strong communication and cross-functional collaboration skills.

• Strong communication
• Cross-functional collaboration
• Problem-solving
• Cloud-native security
• SIEM engineering
• EDR/XDR