SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
GoodLeap is a technology company delivering financing and software products for sustainable home solutions (solar, batteries, HVAC, heat pumps, roofing, windows). Over 1 million homeowners have used the platform, and thousands of professionals rely on GoodLeap's AI-powered applications and developer tools. The company has facilitated over $30 billion in financing for sustainable solutions since 2018.
The Staff Security Engineer, Security Operations role is responsible for protecting GoodLeap's cloud environments, applications, endpoints, and corporate systems. This is a senior individual contributor and technical leader position that combines detection engineering, incident response, and security operations management.
Key responsibilities include:
**Detection Engineering & Monitoring:** Design, build, test, and tune detections across cloud, identity, endpoint, and email telemetry using detection-as-code practices mapped to MITRE ATT&CK. Manage security logging, SIEM, and alerting pipelines. Establish monitoring of AI activity, including AI tools, agents, MCP integrations, and API keys to detect data exposure, misuse, and anomalous behavior. Reduce time-to-detect through applied threat intelligence and sensor enrichment.
**Incident Response:** Lead investigation, containment, eradication, and recovery for security incidents. Serve as incident lead for significant events and coordinate with legal, compliance, and leadership on regulatory notification obligations. Maintain incident response plans, playbooks, and runbooks. Conduct tabletop exercises and post-incident reviews that drive lasting control improvements.
**Security Tooling, Automation & AI Agents:** Deploy and manage the security operations toolset, including cloud security monitoring, WAF, DDoS protection, IDS, EDR (CrowdStrike), and email security. Build AI agents and automation for alert triage, enrichment, investigation, and response. Review results from vulnerability scans and penetration testing. Serve as a subject matter expert on AWS cloud security and consult on secure design of cloud-based systems.
**Mentorship & Leadership:** Provide mentorship and guidance to the security team and partner engineering teams on detection, response, and security operations practices. Share in-depth understanding of company and industry methodologies, policies, standards, and controls. Help build the security team and lead efforts to mature GoodLeap's security operations capability.
**Requirements:**
- In-depth knowledge of Amazon AWS, including security configuration, logging, and tooling (CloudTrail, GuardDuty, Security Hub)
- Hands-on experience in detection engineering, including SIEM query languages and detection-as-code
- Hands-on experience in incident response, including log analysis and host and cloud investigation
- Familiarity with MITRE ATT&CK framework and OWASP Top 10
- Knowledge of network and web related protocols (TCP/IP, DNS, HTTP, HTTPS, TLS)
- Experience with, or ability to quickly ramp on, EDR platforms (CrowdStrike Falcon preferred)
- Experience with, or ability to quickly ramp on, email security (phishing, BEC, DMARC/SPF/DKIM)
- Experience building automation in Python or similar language
- Experience building or integrating LLM-based agents and workflows
- Understanding of AI-specific risks such as prompt injection, data leakage, and excessive agent permissions
- Experience working in a SOC 2, PCI-DSS, or ISO control environment
- Proven ability to combine business acumen, technical acumen, and process expertise to assess requirements and alignment
- Strong communicator across verbal, written, ticketing, and messaging channels
- Able to prioritize and deliver on multiple tasks independently with strong bias toward action in fast-paced environment
- Certifications a plus: GCIH, GCFA, GCDA, CCSP, CISSP, CrowdStrike, or comparable
