Senior Security Engineer

Responsibilities

• Build and operate the Security Observability & Data Platform (tens of TB/month and growing). This covers ingestion, normalization and retention, plus the query and detection layer on top. Detections are code: tested, reviewed, and measured for precision.
• Own endpoint security across the fleet: deploy, tune and respond with EDR; run and configure binary authorization; and set hardening baselines with IT Operations.
• Lead threat hunting, internal investigations and insider-threat work. Handle security incidents end to end: triage, containment, forensics, root cause, and the control that prevents a repeat.
• Build the next generation of security services and run them in production: zero-trust AuthN/AuthZ, a uniform blocking service, an application proxy, asset inventory, developer portal, and compliance as code.
• Build and run the agent platform (local and Kubernetes). Use LLM agents to automate triage, enrichment, investigation and response, with deterministic checks wherever a model's answer isn't enough.
• Review infrastructure and cloud designs (Kubernetes, AWS/GCP, bare metal, CI runners) for security, and help engineering teams adopt the shared services instead of building their own.
• Run red-team and adversary-emulation exercises, and turn the results into detections and fixes.
• Write runbooks and post-mortems that someone who wasn't in the room can follow at 3 a.m.

Languages