Senior Security Operations Engineer

The role

Detection, response, and automation

• Triage, investigate, and contain alerts; manage SIEM data and detection content; coordinate managed detection partner operating procedures.
• Track detection and response metrics, tune alerts, write incident playbooks, conduct tabletop exercises, and perform hypothesis-driven threat hunting.
• Build AI-assisted security workflows and automate enrichment, triage, containment, API integrations, evidence collection, inventory reconciliation, and reporting.

Vulnerability and infrastructure security

• Manage vulnerability scanning, risk-based prioritization, remediation SLAs, verification, asset ownership, and penetration-test follow-up.
• Operate CSPM/CNAPP across AWS, Azure, GCP, and Kubernetes; support infrastructure-as-code baselines, policy enforcement, drift detection, secrets management, and EDR.

Identity, AI security, and governance

• Support privileged access, phishing-resistant MFA, conditional access, access reviews, and detections for credential abuse and AI-enabled social engineering.
• Configure DLP for AI channels and shadow-AI controls; support AI risk tiering and scoped red-team exercises.
• Report security metrics, support SOC 2 and ISO 27001 evidence collection, and maintain runbooks and continuity-test evidence.

Required qualifications

• 5–8 years of hands-on security operations experience, including incident triage, investigation, and containment.
• Practical SIEM experience, public cloud security in at least one of AWS, Azure, or GCP, and working knowledge of Kubernetes and container security.
• Hands-on EDR operation, vulnerability management at scale, and scripting and automation using Python, REST APIs, and Terraform.
• Working knowledge of identity platforms and attacks, NIST CSF, and the judgment to apply AI to security with appropriate human review.
• Strong written communication for operational documentation.

Nice to have

• SOAR development, CNAPP/CSPM, DLP/CASB/SSE, threat hunting, privileged access management, email security, MDM, network security, backup security, or detection-as-code experience.
• AI/LLM security exposure and certifications such as GCIA, GCIH, GCFA, OSCP, AWS Security Specialty, Security+, or CISSP are desirable.
• A bachelor's degree in Computer Science, Information Security, or a related field is desirable.

About Couchbase