{"id":2959,"url":"https://alion.io/job/arcana-lead-security-engineer","title":"Senior Security Engineer","company":{"id":1050,"name":"Arcana","domain":"arcana.io","url":"https://alion.io/company/arcana","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"D","score":50,"open_postings":25,"ghost_share":0.84,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":19500,"max_usd":43000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"DLP","optional":false},{"name":"DNS","optional":false},{"name":"GCP","optional":false},{"name":"Google GKE","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"CI/CD","optional":true}],"status":"live","first_seen_at":"2025-06-13T08:37:44Z","employer_posted_date":"2026-09-21","last_verified_at":"2026-10-16T20:31:34Z","board_verified":true,"closed_at":null,"days_open":490,"trust":{"level":"ghost","repost_count":0,"flags":["stale","company_stale"],"days_open":489},"description":"Senior Security Engineer \nWe are looking for a hands-on Senior Security Engineer to own and improve security operations across our corporate IT, cloud, and Kubernetes environments. The role covers security monitoring and detection, incident response, security tooling and integrations, automation, and day-to-day IT security.\nWhat You'll Do\nOwn security monitoring, triage, investigation, and incident response across endpoint, identity, email, network, SaaS, GCP, and GKE environments.\nOperate and improve security capabilities across SIEM, EDR, DLP, cloud security, network security, and identity security.\nIntegrate security tools and telemetry into the SOC to improve visibility, correlation, investigation, and response.\nBuild and tune detections, correlation rules, alerts, dashboards, and monitoring use cases based on attack scenarios and observed activity.\nBuild automated workflows for alert enrichment, triage, investigation, containment, escalation, and response using APIs and scripting.\nInvestigate incidents end-to-end, including scoping, evidence collection, root-cause analysis, containment, remediation, and post-incident actions.\nMonitor and investigate GCP and GKE activity, including IAM changes, service-account activity, cloud audit events, Kubernetes activity, workload behaviour, and network events.\nIdentify gaps and misconfigurations across cloud IAM, Kubernetes RBAC, workloads, containers, secrets, network controls, logging, and security configurations.\nManage and tune DLP controls and investigate potential data-exfiltration or policy-violation events.\nInvestigate phishing and account-compromise activity, including email headers, URLs, domains, attachments, authentication events, and indicators of compromise.\nSupport IT security across endpoints, device posture, identity and access, SaaS applications, privileged access, and security configurations.\nWork with infrastructure and engineering teams to remediate security findings and improve logging, detection coverage, and preventive controls.\nMaintain practical incident-response playbooks, detection documentation, and investigation procedures.\nWhat You'll Need\n5-7 years of hands-on cybersecurity experience, with strong experience in security operations, security engineering, or incident response.\nStrong hands-on experience with SIEM and EDR, including log analysis, detection development, alert tuning, investigation, and response.\nExperience integrating security technologies and telemetry using APIs, webhooks, scripts, or automation/orchestration platforms.\nExperience building and automating SOC and incident-response workflows rather than relying entirely on manual triage.\nHands-on experience securing and monitoring Google Cloud Platform (GCP).\nStrong understanding of GCP IAM, service accounts, audit logging, VPC networking, storage, KMS, and cloud security controls.\nHands-on security experience with Kubernetes/GKE, including RBAC, service accounts, namespaces, secrets, network policies, workload security, container security, and audit logging.\nAbility to investigate activity across cloud control-plane, Kubernetes, container/workload, identity, and network telemetry.\nGood understanding of DLP and experience tuning policies and investigating data-security events.\nStrong networking fundamentals, including DNS, HTTP/S, TCP/IP, VPNs, proxies, firewalls, and network traffic analysis.\nExperience investigating phishing, credential compromise, endpoint threats, suspicious network activity, cloud events, and container/Kubernetes security events.\nUnderstanding of common attacker behaviours and techniques, including privilege escalation, credential abuse, persistence, lateral movement, and data exfiltration.\nWorking knowledge of MITRE ATT&CK and its practical application to detection and investigation.\nHands-on scripting or automation experience with Python, shell scripting, or similar technologies.\nAbility to independently take a security event from initial detection through investigation, containment, remediation, and closure.\nGood to Have\nExperience building or maturing a SOC/security operations capability in a cloud-first environment.\nExperience with security orchestration and automated response.\nExperience with cloud security posture management, vulnerability management, and container/workload security.\nExperience developing custom detections using telemetry from multiple security and infrastructure sources.\nFamiliarity with Infrastructure-as-Code and CI/CD security from an operational security perspective.","description_format":"text","description_chars":4537,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Software & Embedded Finance","Financial Data & Market Intelligence"],"lifecycle":[{"event":"open","at":"2025-06-13T08:37:44Z"}],"visa":[],"liveness":{"score":5,"band":"cold","label":"Long shot","p_open":1,"p_active":0.194,"p_room":0.28,"age_days":489,"expected_fill_days":38,"reasons":["conf:3","stale_co","ghost","win:tail","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/arcana-lead-security-engineer","json_url":"https://alion.io/job/arcana-lead-security-engineer.json","meta":{"generated_at":"2026-10-16T21:23:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2336,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1050},"rest":"https://alion.io/mcp/rest/get_company?id=1050"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farcana-lead-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farcana-lead-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farcana-lead-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/arcana-lead-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farcana-lead-security-engineer"}]}