About the role

Security Operations Engineer operating SIEM and SOAR capabilities for Alpaca, a global brokerage infrastructure provider. Building detections, automating incident response, and improving security operations.

Responsibilities

Own the daily operation and continuous improvement of Alpaca’s SIEM and SOAR capabilities
Onboard security logs across cloud, identity, endpoint, SaaS, and application systems, including parsing, normalization, and data quality checks
Build, test, and tune detection rules based on threat intelligence, incident learnings, and emerging attack techniques, mapped to frameworks such as MITRE ATT&CK
Tune, enrich, and manage the lifecycle of detections so alerts stay actionable
Maintain detections for critical systems and priority attack techniques
Build and maintain dashboards for alert volume, ingest health, and response status
Support security incidents with evidence collection, detection queries, and containment actions
Develop and improve alert-handling and incident response runbooks and escalation paths
Track and report security operations metrics, including MTTD and MTTR
Participate in the Security Operations on-call rotation after onboarding and cross-training
Design, build, and maintain SOAR playbooks automating enrichment, containment, ticketing, and notification
Triage, investigate, and respond to security alerts across endpoints, identity, cloud, network, and application logs
Run hypothesis-driven threat hunts and turn findings into new detections
Report to the Enterprise Security Architect and collaborate with Security, IT, DevOps, Engineering, and external partners

3+ years of experience in Security Operations or detection engineering roles
Hands-on experience operating and tuning a SIEM
Experience building SOAR playbooks or equivalent response automation
Working with Linux
Scripting or automation experience (Python, Bash) for security operations tasks
Experience onboarding and parsing log sources from cloud, identity, and SaaS platforms
Strong alert investigation skills across identity, endpoint, network, and cloud environments
Understanding of common attacker techniques and detection methodologies
Experience supporting security incidents, including evidence collection, detection queries, and containment
Willing to participate in an on-call rotation
Strong written and verbal communication skills, especially during incidents
Comfortable working cross-functionally and handling escalations calmly and decisively
Experience securing financial, trading, or other highly regulated platforms
Familiarity with compliance frameworks such as SOC 2 or ISO 27001
Experience with detection-as-code, GitOps, and CI/CD pipelines
Knowledge of cloud security logging (AWS/GCP/Azure) and SaaS security telemetry
Familiarity with Kubernetes-hosted security tooling
Experience working with a managed SOC or MSSP
Security certifications (GCIA, GCIH, GCED, or similar)
Ability to balance security rigor with operational efficiency and business needs