Security Operations Engineer

Job not on LinkedIn

🔥 4 minutes ago

🏈 North America – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🛡️ Security Operations

👻 Ghost score 25%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Alpaca

WebsiteLinkedInAll Job Openings

201 - 500 employees

🔌 API

💳 Fintech

₿ Crypto

API • Fintech • Crypto

Alpaca is a fintech company that provides a comprehensive brokerage and trading platform through a suite of APIs. These APIs enable developers and businesses to integrate algorithmic trading, app development, and embedded investing into their services. Alpaca offers services like trading in US stocks, ETFs, and cryptocurrency with options for local currency transactions. The company is recognized for its cyber security practices and is a member of FINRA and SIPC. Alpaca is ideal for fintech startups, broker-dealers, hedge funds, and other financial services looking to build sophisticated trading applications and platforms with minimal friction through their well-documented Broker API.

📋 Description

• Own the daily operation and continuous improvement of Alpaca’s SIEM and SOAR capabilities • Onboard security logs across cloud, identity, endpoint, SaaS, and application systems, including parsing, normalization, and data quality checks • Build, test, and tune detection rules based on threat intelligence, incident learnings, and emerging attack techniques, mapped to frameworks such as MITRE ATT&CK • Tune, enrich, and manage the lifecycle of detections so alerts stay actionable • Maintain detections for critical systems and priority attack techniques • Build and maintain dashboards for alert volume, ingest health, and response status • Support security incidents with evidence collection, detection queries, and containment actions • Develop and improve alert-handling and incident response runbooks and escalation paths • Track and report security operations metrics, including MTTD and MTTR • Participate in the Security Operations on-call rotation after onboarding and cross-training • Design, build, and maintain SOAR playbooks automating enrichment, containment, ticketing, and notification • Triage, investigate, and respond to security alerts across endpoints, identity, cloud, network, and application logs • Run hypothesis-driven threat hunts and turn findings into new detections • Report to the Enterprise Security Architect and collaborate with Security, IT, DevOps, Engineering, and external partners

🎯 Requirements

• 3+ years of experience in Security Operations or detection engineering roles • Hands-on experience operating and tuning a SIEM • Experience building SOAR playbooks or equivalent response automation • Working with Linux • Scripting or automation experience (Python, Bash) for security operations tasks • Experience onboarding and parsing log sources from cloud, identity, and SaaS platforms • Strong alert investigation skills across identity, endpoint, network, and cloud environments • Understanding of common attacker techniques and detection methodologies • Experience supporting security incidents, including evidence collection, detection queries, and containment • Willing to participate in an on-call rotation • Strong written and verbal communication skills, especially during incidents • Comfortable working cross-functionally and handling escalations calmly and decisively • Experience securing financial, trading, or other highly regulated platforms • Familiarity with compliance frameworks such as SOC 2 or ISO 27001 • Experience with detection-as-code, GitOps, and CI/CD pipelines • Knowledge of cloud security logging (AWS/GCP/Azure) and SaaS security telemetry • Familiarity with Kubernetes-hosted security tooling • Experience working with a managed SOC or MSSP • Security certifications (GCIA, GCIH, GCED, or similar) • Ability to balance security rigor with operational efficiency and business needs

🏖️ Benefits

• Competitive Salary & Stock Options • Health Benefits • New Hire Home-Office Setup: One-time USD $500 • Monthly Stipend: USD $150 per month via a Brex Card

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume