Staff Cloud Detection & Response Engineer

ID.me is seeking a Staff Cloud Detection & Response Engineer to lead threat detection, investigation, and incident response across its cloud environments, Kubernetes workloads, and CI/CD surface. The role serves as the technical authority during high-severity incidents and advises engineering and platform teams on secure-by-design practices.

Responsibilities

• Lead high-severity cloud security incidents with full technical authority from initial detection through containment, eradication, and recovery across cloud infrastructure, Kubernetes (EKS/GKE), and CI/CD-deployed workloads
• Engineer immutable cloud forensics pipelines, including automated disk and memory snapshot capture at the moment of containment, so evidence from ephemeral compute and Kubernetes pods survives autoscaling and termination
• Advise engineering and platform teams on secure-by-design cloud architecture, IAM least-privilege structures, network security perimeters (e.g., AWS Organizations SCPs / VPC Service Controls), and workload identity, serving as a technical reviewer and consultant rather than the engineer implementing the change
• Drive visibility into CI/CD pipelines for security signals (such as dependency/SBOM findings, secret-scanning alerts, and admission-control violations) surfaced to your team for detection and response, rather than owning the pipeline configuration itself
• Conduct deep Kubernetes runtime security investigations, including cluster and node compromise, container escape scenarios, malicious admission-controller bypass, and workload identity abuse at the pod, node, and API-server level
• Perform proactive threat hunting for IOCs and APT TTPs specific to cloud and container environments, translating cloud-native telemetry (CloudTrail/Cloud Audit Logs, VPC/network flow logs, Kubernetes audit logs) into concrete detections
• Own incident command during major cloud incidents by directing cross-functional responders, making real-time containment decisions, and communicating status to executive leadership without needing to escalate the decision upward
• Lead root-cause and post-incident review for cloud incidents, translating findings into concrete architectural recommendations that platform/engineering teams own and implement
• Mentor SOC and IR analysts on cloud- and container-native investigation techniques, raising the team's overall fluency in cloud threat detection
• Stay current on cloud-native security services and emerging cloud attack techniques, and drive their adoption into detection content and incident playbooks

Skills

• 8+ years of experience in information security, with extensive hands-on experience in incident response, threat hunting, and forensic analysis
• 3+ years leading incident response in cloud environments (AWS and/or GCP required)
• Scripting/automation proficiency (Python, Go, bash) for detection engineering and forensic tooling
• Deep, working knowledge of cloud IAM least-privilege design, including custom/managed roles, service account or role impersonation risk, workload identity federation, and organization-level policy constraints
• Deep, hands-on knowledge of Kubernetes (EKS/GKE) and container runtime security, covering container escape scenarios, runtime protection, admission control, and image scanning/provenance
• Demonstrated experience building or specifying immutable cloud forensics workflows, including automated snapshotting of disks and memory for ephemeral and autoscaled compute
• Experience advising on (not necessarily authoring) CI/CD pipeline security, covering secrets exposure, build/deploy compromise, dependency, and supply-chain risk
• 4+ years detecting, analyzing, and mitigating complex threats using SIEM (e.g., Chronicle, Splunk), EDR, DLP, IDS/IPS, and CSPM/CWPP tooling
• Demonstrated ability to run incident command with authority by directing response across teams during a high-severity, high-visibility cloud incident
• Experience across both AWS and GCP is a plus, but not required
• Familiarity with Infrastructure as Code (Terraform) and GitOps workflows sufficient to review and advise on security guardrails, even without direct authorship responsibility
• Experience with service mesh security policy (Istio, Linkerd) from an investigative/advisory standpoint
• Advanced certifications: GCIA, GCIH, GCFA, CISSP, CKS (Certified Kubernetes Security Specialist), or a cloud provider security certification (AWS Security – Specialty, GCP Professional Cloud Security Engineer)
• Experience with AI/ML-assisted triage and detection engineering, and awareness of securing AI/LLM pipelines
• Proven track record developing insider threat detection strategies and writing detection signatures
• Proficiency leading forensic investigations across Linux, MacOS, and Windows in addition to cloud environments
• Prior experience contributing to SOC/IR process maturity and incident command frameworks

Benefits

• Comprehensive medical, dental, and vision insurance
• Health savings account
• Flexible spending accounts (medical, limited purpose, dependent care, and commuter benefit accounts)
• Basic and voluntary life and AD&D insurance
• 401(k) with company match
• Parental leave
• Unlimited paid time off, subject to the terms and conditions of the PTO policy
• 8 company-wide holidays
• Short- and long-term disability insurance
• Accident and critical illness insurance
• Referral bonus policy
• Employee assistance program
• Pet insurance
• Travel assistant program
• Wellbeing and childcare discounts
• Benefit advocates
• Learning and development benefit

Company Overview

Company H1B Sponsorship