{"id":20742,"url":"https://alion.io/job/solace-sr-security-engineer-detection","title":"Sr. Security Engineer (Detection)","company":{"id":4232,"name":"Solace","domain":"solace.health","url":"https://alion.io/company/solace","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":81,"open_postings":4,"ghost_share":0,"stale_share":0.75,"repost_share":0,"time_to_fill_p50_days":38,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":150000,"max":200000,"currency":"USD","period":"year","gross":null,"usd_annual":200000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Datadog","optional":false},{"name":"Datadog Cloud Security","optional":false},{"name":"GCP","optional":false},{"name":"GitHub","optional":false},{"name":"Google Workspace","optional":false},{"name":"HIPAA","optional":false},{"name":"Least Privilege","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Okta","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Slack","optional":false},{"name":"Snowflake","optional":false},{"name":"SOC 2","optional":false},{"name":"Splunk","optional":false},{"name":"CI/CD","optional":true},{"name":"Terraform","optional":true},{"name":"Tines","optional":true}],"status":"live","first_seen_at":"2026-07-23T21:53:59Z","employer_posted_date":"2026-09-17","last_verified_at":"2026-10-16T09:47:54Z","board_verified":true,"closed_at":null,"days_open":84,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":84},"description":"About Solace\nHealthcare in the U.S. is fundamentally broken. The system is so complex that 88% of U.S. adults do not have the health literacy necessary to navigate it without help. Solace cuts through the red tape of healthcare by pairing patients with expert advocates and giving them the tools to make better decisions-and get better outcomes.\nWe're a Series C startup, founded in 2022 and backed by Inspired Capital, Craft Ventures, Torch Capital, Menlo Ventures, Signalfire, and IVP. Our U.S. based team is lean, mission-driven, and growing quickly.\nSolace isn't a place to coast. We're here to redefine healthcare-and that demands urgency, precision, and heart. If you're looking to stretch yourself, sharpen your edge, and do the best work of your life alongside a team that cares deeply, you're in the right place. We’re intense, and we like it that way.\nRead more in our Bloomberg funding announcementhere.\nAbout the Role\nWe're looking for a Sr. Security Engineer to join our growing security team at Solace. You'll be a generalist at heart, but your first and most important mission is clear: own our detection and alerting program end to end.\nWe have the raw materials in place - a Datadog SIEM with logs flowing in from across our identity, cloud, endpoint, and SaaS stack - but we need someone who can turn that telemetry into a high-signal detection program. You'll decide what we detect, write and tune the rules, kill the noise, and make sure that when something real happens, we know fast and respond well.\nThis is a hands-on, high-ownership role on a small team in a HIPAA-regulated environment. You'll report to our Staff Security Engineer and work alongside engineers focused on application and infrastructure security. What you build here will be the foundation of security operations at Solace for years.\nWhat You'll Do\nDetection Engineering & SIEM Ownership (Primary Focus)\nOwn our Datadog Cloud SIEM: log pipelines, parsing, enrichment, retention, and cost management\n\nBuild, tune, and maintain detection rules across our environment - identity (Okta, Google Workspace), cloud (AWS, GCP), endpoint (Jamf), data platforms (Snowflake), and SaaS audit logs (GitHub, Slack, and more)\n\nSystematically reduce alert noise and drive alert quality metrics (fidelity, time-to-triage, false-positive rates)\n\nMap detection coverage against real-world threats (MITRE ATT&CK) and close the highest-risk gaps first\n\nTreat detections as code: version-controlled, tested, documented, and peer-reviewed\n\nEnsure logging and audit trails meet HIPAA requirements for ePHI systems\n\nIncident Response\nServe as a primary responder for security alerts and incidents: triage, investigate, contain, and document\n\nImprove and extend our incident response playbooks, and run post-incident reviews that produce real fixes\n\nBuild automation to speed up triage and response (enrichment, auto-containment, workflow automation)\n\nParticipate in and help mature our on-call rotation as the team grows\n\nGeneralist Security Engineering\nContribute to cloud and infrastructure security hardening across AWS and GCP\n\nSupport identity and access management improvements (Okta policies, access reviews, least privilege)\n\nPitch in on vendor security reviews, security questionnaires, and audit evidence gathering (HIPAA, SOC 2)\n\nHelp build a security-first culture through documentation, tooling, and partnership with engineering teams\n\nWhat We're Looking For\nRequired:\n3-6 years in security operations, detection engineering, incident response, or similar hands-on security roles\n\nReal experience building and tuning detections in a SIEM - Datadog Cloud SIEM strongly preferred, but deep experience with Splunk, Elastic, Chronicle, Sentinel, or Panther translates well\n\nFluency reading and correlating logs from cloud providers (CloudTrail, GCP audit logs), identity providers, and SaaS platforms\n\nHands-on incident response experience: you've triaged real alerts, worked real incidents, and written the post-mortems\n\nScripting ability (Python or similar) for automation, log analysis, and detection tooling\n\nStrong understanding of common attack patterns - phishing, credential compromise, SSO abuse, cloud misconfigurations, supply chain risks\n\nComfortable with ambiguity and building from scratch; startup or small-team experience is a strong signal\n\nNice to Have:\nExperience in healthcare or other regulated environments (HIPAA, SOC 2, HITRUST)\n\nDetection-as-code workflows (Terraform, CI/CD for detections)\n\nSOAR or workflow automation experience (Tines, Windmill, custom tooling)\n\nFamiliarity with Okta, Jamf, Snowflake, GitHub, or Vanta from a security operations perspective\n\nThreat hunting experience or contributions to open-source detection content\n\nWorking Style:\nBias toward action - you'd rather ship a good detection today and iterate than design the perfect one for a month\n\nHigh signal in communication: clear incident writeups, honest post-mortems, and the ability to explain risk to non-security audiences\n\nStrong ownership mentality - you notice gaps and close them without being asked\n\nCollaborative and low-ego on a small team where everyone wears multiple hats\n\nCare about doing security right in an environment where patient data is at stake\n\nApplicants must be based in the United States.\nUp for the Challenge?\nWe look forward to meeting you.\nFraudulent Recruitment Advisory: Solace Health will NEVER request bank details or offer employment without an interview. All legitimate communications come from official solace.health emails only or ashbyhq.com. Report suspicious activity to  or .","description_format":"text","description_chars":5641,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Patient Access & Booking","Care Coordination & Population Health"],"lifecycle":[{"event":"open","at":"2026-07-23T21:53:59Z"},{"event":"close","at":"2026-09-04T08:11:37Z"},{"event":"reopen","at":"2026-09-17T17:52:05Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"Filed H-1B visas in the last two years","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":null,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":16,"band":"cold","label":"Long shot","p_open":1,"p_active":0.589,"p_room":0.28,"age_days":84,"expected_fill_days":38,"reasons":["conf:1","velocity","win:tail","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":{"stated_usd_annual":200000,"is_top_pay":true},"html_url":"https://alion.io/job/solace-sr-security-engineer-detection","json_url":"https://alion.io/job/solace-sr-security-engineer-detection.json","meta":{"generated_at":"2026-10-16T13:11:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12644,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4232},"rest":"https://alion.io/mcp/rest/get_company?id=4232"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsolace-sr-security-engineer-detection"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsolace-sr-security-engineer-detection"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsolace-sr-security-engineer-detection"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/solace-sr-security-engineer-detection\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsolace-sr-security-engineer-detection"}]}