SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Cyera is building the security operating model for the age of AI. The company provides a unified control plane that understands relationships between data, access, and behaviors across humans, systems, and AI—enabling businesses to accelerate AI adoption while maintaining security.
As a Security Operations Engineer, you will own escalated investigations end-to-end, lead the response to moderate-scope incidents, and improve the detections, playbooks, and automations behind Cyera's agentic SOC. This role emphasizes spending more time improving the system than working the queue.
Key responsibilities include:
- Investigation Ownership: Own escalated investigations from triage to closure, including correlation, scoping, and remediation coordination.
- Incident Response: Lead moderate-scope incidents, serve as a core responder on major incidents, and write after-action reports.
- Detection Engineering: Build and tune detections across cloud, identity, SaaS, and endpoint telemetry, with test cases and documented rationale.
- SOC Automation: Improve agent workflows, enrichment, and playbooks, and measure the effect on autonomous handling and time to resolution.
- Customer Zero Program: Own a domain of the internal Cyera deployment, managing posture goals, remediation with data owners, and prioritized product feedback.
- Threat Hunting: Run hypothesis-driven hunts and convert findings into detections or automations.
- Mentorship: Review the work of newer Security Operations Engineers, pair on investigations, and help them build engineering habits.
You will join a team building a modern, AI-assisted SOC from the ground up at a fast-growing data and AI security company. Your work will directly shape detection and response capabilities, how agents operate, and how the product behaves.
REQUIREMENTS:
- 2 to 4 years of experience in security operations, incident response, or detection engineering
- Experience leading or co-leading incidents, including containment decisions and post-incident write-ups
- Working knowledge of AWS security services, IAM, logging, and common cloud attack paths
- AWS Certified Cloud Practitioner certification (required); AWS Security Specialty or Solutions Architect Associate preferred
- Hands-on Python proficiency with automation others rely on
- Experience building, tuning, and maintaining detections and investigating from raw logs
- Ability to write clear incident reports and brief non-technical stakeholders
NICE TO HAVE:
- Hands-on work with LLM applications, agent frameworks, or AI-assisted security operations
- Detection languages: Sigma, SQL, KQL, SPL, YARA, or similar
- Experience with DSPM, DLP, or data access governance
- Infrastructure as Code: Terraform, CloudFormation, or CDK
- Certifications: GCIH, GCIA, GCFA, AWS Security Specialty, or similar
