{"id":3760605,"url":"https://alion.io/job/id-me-staff-cloud-detection-response-engineer","title":"Staff Cloud Detection & Response Engineer","company":{"id":1754256,"name":"ID.me","domain":"id.me","url":"https://alion.io/company/id-1754256","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Welcome to the Jungle","truth_index":{"grade":"A","score":95,"open_postings":5,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":71,"computed_at":"2026-11-07T05:47:08Z"}},"role":"DevOps","role_family":"DevOps","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["McLean, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":154000,"max":199000,"currency":"USD","period":"year","gross":null,"usd_annual":199000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon EKS","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"DLP","optional":false},{"name":"GCP","optional":false},{"name":"Google GKE","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Python","optional":false},{"name":"SBOM","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"GitOps","optional":true},{"name":"Istio","optional":true},{"name":"Linkerd","optional":true},{"name":"LLM","optional":true},{"name":"Service Mesh","optional":true},{"name":"Terraform","optional":true},{"name":"Windows","optional":true}],"status":"closed","first_seen_at":"2026-11-04T17:19:02Z","employer_posted_date":null,"last_verified_at":"2026-11-05T00:20:45Z","board_verified":false,"closed_at":"2026-11-05T00:20:45Z","days_open":0,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":0},"description":"ID.me is seeking a Staff Cloud Detection & Response Engineer to lead threat detection, investigation, and incident response across its cloud environments, Kubernetes workloads, and CI/CD surface. The role serves as the technical authority during high-severity incidents and advises engineering and platform teams on secure-by-design practices.\n\nResponsibilities\nLead high-severity cloud security incidents with full technical authority from initial detection through containment, eradication, and recovery across cloud infrastructure, Kubernetes (EKS/GKE), and CI/CD-deployed workloads\nEngineer immutable cloud forensics pipelines, including automated disk and memory snapshot capture at the moment of containment, so evidence from ephemeral compute and Kubernetes pods survives autoscaling and termination\nAdvise engineering and platform teams on secure-by-design cloud architecture, IAM least-privilege structures, network security perimeters (e.g., AWS Organizations SCPs / VPC Service Controls), and workload identity, serving as a technical reviewer and consultant rather than the engineer implementing the change\nDrive visibility into CI/CD pipelines for security signals (such as dependency/SBOM findings, secret-scanning alerts, and admission-control violations) surfaced to your team for detection and response, rather than owning the pipeline configuration itself\nConduct deep Kubernetes runtime security investigations, including cluster and node compromise, container escape scenarios, malicious admission-controller bypass, and workload identity abuse at the pod, node, and API-server level\nPerform proactive threat hunting for IOCs and APT TTPs specific to cloud and container environments, translating cloud-native telemetry (CloudTrail/Cloud Audit Logs, VPC/network flow logs, Kubernetes audit logs) into concrete detections\nOwn incident command during major cloud incidents by directing cross-functional responders, making real-time containment decisions, and communicating status to executive leadership without needing to escalate the decision upward\nLead root-cause and post-incident review for cloud incidents, translating findings into concrete architectural recommendations that platform/engineering teams own and implement\nMentor SOC and IR analysts on cloud- and container-native investigation techniques, raising the team's overall fluency in cloud threat detection\nStay current on cloud-native security services and emerging cloud attack techniques, and drive their adoption into detection content and incident playbooks\n\nSkills\n8+ years of experience in information security, with extensive hands-on experience in incident response, threat hunting, and forensic analysis\n3+ years leading incident response in cloud environments (AWS and/or GCP required)\nScripting/automation proficiency (Python, Go, bash) for detection engineering and forensic tooling\nDeep, working knowledge of cloud IAM least-privilege design, including custom/managed roles, service account or role impersonation risk, workload identity federation, and organization-level policy constraints\nDeep, hands-on knowledge of Kubernetes (EKS/GKE) and container runtime security, covering container escape scenarios, runtime protection, admission control, and image scanning/provenance\nDemonstrated experience building or specifying immutable cloud forensics workflows, including automated snapshotting of disks and memory for ephemeral and autoscaled compute\nExperience advising on (not necessarily authoring) CI/CD pipeline security, covering secrets exposure, build/deploy compromise, dependency, and supply-chain risk\n4+ years detecting, analyzing, and mitigating complex threats using SIEM (e.g., Chronicle, Splunk), EDR, DLP, IDS/IPS, and CSPM/CWPP tooling\nDemonstrated ability to run incident command with authority by directing response across teams during a high-severity, high-visibility cloud incident\nExperience across both AWS and GCP is a plus, but not required\nFamiliarity with Infrastructure as Code (Terraform) and GitOps workflows sufficient to review and advise on security guardrails, even without direct authorship responsibility\nExperience with service mesh security policy (Istio, Linkerd) from an investigative/advisory standpoint\nAdvanced certifications: GCIA, GCIH, GCFA, CISSP, CKS (Certified Kubernetes Security Specialist), or a cloud provider security certification (AWS Security – Specialty, GCP Professional Cloud Security Engineer)\nExperience with AI/ML-assisted triage and detection engineering, and awareness of securing AI/LLM pipelines\nProven track record developing insider threat detection strategies and writing detection signatures\nProficiency leading forensic investigations across Linux, MacOS, and Windows in addition to cloud environments\nPrior experience contributing to SOC/IR process maturity and incident command frameworks\n\nBenefits\nComprehensive medical, dental, and vision insurance\nHealth savings account\nFlexible spending accounts (medical, limited purpose, dependent care, and commuter benefit accounts)\nBasic and voluntary life and AD&D insurance\n401(k) with company match\nParental leave\nUnlimited paid time off, subject to the terms and conditions of the PTO policy\n8 company-wide holidays\nShort- and long-term disability insurance\nAccident and critical illness insurance\nReferral bonus policy\nEmployee assistance program\nPet insurance\nTravel assistant program\nWellbeing and childcare discounts\nBenefit advocates\nLearning and development benefit\n\nCompany Overview\nID.me is the next-generation digital identity wallet that simplifies how individuals securely prove their identity online. It was founded in 2010, and is headquartered in Mclean, Virginia, USA, with a workforce of 1001-5000 employees. Its website is https://id.me.\n\nCompany H1B Sponsorship\nID.me has a track record of offering H1B sponsorships, with 9 in 2026, 12 in 2025, 2 in 2024. Please note that this does not guarantee sponsorship for this specific role.","description_format":"text","description_chars":5972,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Vision insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Identity Management"],"lifecycle":[{"event":"open","at":"2026-11-04T18:20:00Z"},{"event":"close","at":"2026-11-05T00:20:45Z"}],"visa":[],"liveness":null,"pay":{"stated_usd_annual":199000,"is_top_pay":true},"html_url":"https://alion.io/job/id-me-staff-cloud-detection-response-engineer","json_url":"https://alion.io/job/id-me-staff-cloud-detection-response-engineer.json","meta":{"generated_at":"2026-11-08T04:06:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8835,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1754256},"rest":"https://alion.io/mcp/rest/get_company?id=1754256"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fid-me-staff-cloud-detection-response-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fid-me-staff-cloud-detection-response-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fid-me-staff-cloud-detection-response-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/id-me-staff-cloud-detection-response-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fid-me-staff-cloud-detection-response-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3760605}},{"tool":"search_jobs","arguments":{"company":"id.me","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3760605},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}