Cloud Security Operations Engineer

🔥 1 hour ago

🇲🇽 Mexico – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🛡️ Security Operations

👻 Ghost score 10%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Gainsight

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

☁️ SaaS

🤝 B2B

🏢 Enterprise

💰 $52M Series E - Gainsight on 2017-05

SaaS • B2B • Enterprise

Gainsight is a SaaS company that provides a unified Customer Success platform and related products to help businesses retain, expand, and drive product adoption with their customers. Its offerings include Gainsight CS (customer success), Product Experience (in-app engagements and analytics), Customer Communities, Skilljar (customer education), and AI-powered agents and services (Staircase AI, Agent Studio, Gainsight MCP) that surface insights and automate customer success workflows. Gainsight positions itself as an enterprise-focused, AI-native solution for post-sales teams, emphasizing retention-as-a-service, integrated customer data, and scalability for CSMs and product teams.

📋 Description

• Triage and investigate alerts end-to-end across cloud-native tooling, determining severity and scope and closing with documented findings • Detect and respond to cloud-specific threats, including identity compromise, privilege escalation, access key and token abuse, misconfiguration exploitation, and data exfiltration from cloud storage • Build detections on cloud audit logs, network flow logs, and container and workload telemetry • Run proactive threat hunts using ATT&CK-aligned methods, including the Cloud and Containers matrices • Build automation for cloud containment actions such as credential revocation, instance isolation, and policy quarantine • Lead incident response from scoping and containment through post-incident review • Perform forensics across cloud, host, network, and memory • Report clearly to technical and non-technical stakeholders • Build, tune, and maintain SIEM correlation rules and Sigma-based detection-as-code pipelines • Own the health and reliability of the SecOps tooling estate, including SIEM, EDR, SOAR, and log ingestion pipelines • Maintain coverage, integration uptime, and vendor escalation • Participate in the on-call rotation • Maintain operational runbooks • Contribute to red and purple team exercises • Collaborate cross-functionally with engineering and technical and non-technical stakeholders

🎯 Requirements

• 4+ years in security engineering, SOC operations (T2/T3), or incident response within a complex enterprise environment, including 3+ years defending production cloud workloads • Bachelors Degree (or equivalent experience) and/or 5 years of related experience • Strong knowledge of cloud security architecture and telemetry in at least one major provider (AWS, Azure, or GCP), including the log sources needed for effective detection and investigation • Deep understanding of cloud IAM and identity-based attack paths, such as role assumption abuse, federation weaknesses, and long-lived credential compromise • Hands-on experience investigating real cloud incidents using native cloud logs and forensic acquisition methods • Experience with cloud-native threat detection services and with ingesting and normalizing cloud logs in a SIEM • Working knowledge of core cloud infrastructure: compute, storage, networking, and serverless • Advanced proficiency with an enterprise SIEM, including detection authoring, correlation rules, pipeline administration, and tuning to reduce false positives at scale • Working command of MITRE ATT&CK to map detections to technique coverage, identify telemetry gaps, and design hunts against specific adversary behaviors • Digital forensics experience across host, network, and memory artifacts, including memory acquisition, disk imaging, and multi-source timeline correlation • Scripting in Python, PowerShell, or Bash, with production automation, log enrichment, or tooling integrations • CSPM/CNAPP or cloud workload protection experience preferred • Experience in multi-cloud environments preferred • Container and Kubernetes security experience preferred • IaC for cloud guardrails and security configuration preferred • SOAR experience preferred • Detection-as-code workflows with CI/CD integration and automated rule validation preferred • Relevant professional certifications such as GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer are nice to have

🏖️ Benefits

• Career development and mentoring opportunities • Inclusive, fair, and transparent hiring process • Up to 10–20% travel for team meetings, training, or company events • Employment terms and benefits may be provided through an Employer of Record (EOR), where applicable

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume