{"id":3049209,"url":"https://alion.io/job/goodleap-staff-security-engineer-security-operations","title":"Staff Security Engineer, Security Operations","company":{"id":6926,"name":"GoodLeap","domain":"goodleap.com","url":"https://alion.io/company/goodleap","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":79,"open_postings":6,"ghost_share":0,"stale_share":0.833,"repost_share":0,"time_to_fill_p50_days":36,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Roseville, United States","San Francisco, United States","Austin, United States","Seattle, United States","New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":167400,"max":212500,"currency":"USD","period":"year","gross":null,"usd_annual":212500},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Crowdstrike","optional":false},{"name":"DNS","optional":false},{"name":"Falcon","optional":false},{"name":"LLM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"TCP/IP","optional":false}],"status":"live","first_seen_at":"2026-10-21T23:32:55Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-10-26T12:57:50Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"Position Summary\nThe Staff Security Engineer, Security Operations is responsible for protecting GoodLeap’s cloud environments, applications, endpoints, and corporate systems through detection engineering, incident response, and security operations. This role builds and tunes detections, leads investigation and response for security incidents, and manages the security tooling that provides visibility across cloud, identity, endpoint, and email. The Staff Security Engineer will design and build AI agents and automation that reduce time-to-detect and time-to-respond, and will establish monitoring of AI activity across the enterprise, including AI tools, agents, and integrations used by employees and engineering teams. This role works closely with software engineers, infrastructure, IT, and compliance partners to ensure security controls are consistently applied and operationally effective.\nAdditionally, the Staff Security Engineer develops security requirements, conducts security risk assessments, evaluates security services and technologies, maintains incident response plans and runbooks, and provides mentoring to the security team and partner engineering teams. This role will own endpoint detection and response (CrowdStrike) and email security as these capabilities are brought into the security function.\nEssential Job Duties and Responsibilities\nDetection Engineering & Monitoring\nDesign, build, test, and tune detections across cloud, identity, endpoint, and email telemetry using detection-as-code practices mapped to MITRE ATT&CK. \nManage security logging, SIEM, and alerting pipelines. \nEstablish monitoring of AI activity, including AI tools, agents, MCP integrations, and API keys, to detect data exposure, misuse, and anomalous behavior. \nReduce time-to-detect through applied threat intelligence and sensor enrichment. \nIncident Response\nLead investigation, containment, eradication, and recovery for security incidents. \nServe as incident lead for significant events and coordinate with legal, compliance, and leadership on regulatory notification obligations. \nMaintain incident response plans, playbooks, and runbooks. \nConduct tabletop exercises and post-incident reviews that drive lasting control improvements. \nSecurity Tooling, Automation & AI Agents\nDeploy and manage the security operations toolset, including cloud security monitoring, WAF, DDoS protection, IDS, EDR (CrowdStrike), and email security.\nBuild AI agents and automation for alert triage, enrichment, investigation, and response.\nReview results from vulnerability scans, penetration testing, and other sources for true positives and propose remediation or mitigating controls.\nServe as a subject matter expert (SME) on AWS cloud security and consult on the secure design of cloud-based systems. \nMentorship & Leadership\nProvide mentorship and guidance to the security team and partner engineering teams on detection, response, and security operations practices. \nShare in-depth understanding of company and industry methodologies, policies, standards, and controls. \nHelp build the security team and lead efforts to mature GoodLeap’s security operations capability. \nRequired Skills, Knowledge and Abilities\nIn-depth knowledge of Amazon AWS, including security configuration, logging, and tooling (e.g., CloudTrail, GuardDuty, Security Hub). \nHands-on experience in detection engineering, including SIEM query languages and detection-as-code. \nHands-on experience in incident response, including log analysis and host and cloud investigation. \nFamiliar with the MITRE ATT&CK framework and OWASP Top 10. \nKnowledge of network and web related protocols (e.g., TCP/IP, DNS, HTTP, HTTPS, TLS). \nExperience with, or ability to quickly ramp on, EDR platforms (CrowdStrike Falcon preferred). \nExperience with, or ability to quickly ramp on, email security (phishing, BEC, DMARC/SPF/DKIM). \nExperience building automation in Python or a similar language. \nExperience building or integrating LLM-based agents and workflows. \nUnderstanding of AI-specific risks such as prompt injection, data leakage, and excessive agent permissions. \nExperience working in a SOC 2, PCI-DSS, or ISO control environment. \nProven ability to combine business acumen, technical acumen, and process expertise to assess requirements and alignment. \nStrong communicator across verbal, written, ticketing, and messaging channels. \nAble to prioritize and deliver on multiple tasks independently with a strong bias toward action in a fast-paced environment. \nGCIH, GCFA, GCDA, CCSP, CISSP, CrowdStrike, or comparable certifications are a plus.","description_format":"text","description_chars":4608,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Software & Embedded Finance","Mortgage Lending & Brokers"],"lifecycle":[{"event":"open","at":"2026-10-22T01:49:10Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 27 · green card filings: 2","filings_12m":27,"filings_prev_12m":13,"green_card_filings_12m":2,"median_offered_wage_usd":160431,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":4,"expected_fill_days":36,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-10-26T05:57:25Z"},"pay":{"stated_usd_annual":212500,"is_top_pay":true},"html_url":"https://alion.io/job/goodleap-staff-security-engineer-security-operations","json_url":"https://alion.io/job/goodleap-staff-security-engineer-security-operations.json","meta":{"generated_at":"2026-10-26T18:14:09Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":24500,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6926},"rest":"https://alion.io/mcp/rest/get_company?id=6926"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgoodleap-staff-security-engineer-security-operations"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgoodleap-staff-security-engineer-security-operations"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgoodleap-staff-security-engineer-security-operations"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/goodleap-staff-security-engineer-security-operations\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgoodleap-staff-security-engineer-security-operations"}]}