> Markdown version of [/jobs/ext/1957394-senior-information-security-engineer-detection-automation-ai](https://www.wearedevelopers.com/jobs/ext/1957394-senior-information-security-engineer-detection-automation-ai). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Information Security Engineer (Detection, Automation & AI)

- **Company:** Zoox
- **Location:** Foster City, CA, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Audit Trail, Cyber Security, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Log Analysis, Open Source Technology, Kusto Query Language, Security Information and Event Management, Data Processing, Large Language Models, Mitre Att&ck, Amazon Virtual Private Cloud (VPC), Cortex XSOAR Platform, Kibana, Restful APIs, Terraform, Splunk, Devsecops
- **Published:** August 6, 2026
- **Apply:** https://us.experteer.com/career/view-jobs/senior-information-security-engineer-detection-automation-and-ai-foster-city-ca-usa-58814638

## About the Role

response point for security incidents, guiding containment, eradication, and recovery per IR procedures * Monitor and secure AWS and on-prem workloads across multiple operating systems; perform post-incident reviews to drive automated prevention and detections Tasks * 8+ years of information security, security operations, or DevSecOps experience * Deep hands-on experience with Splunk (SPL, Enterprise Security) or ElasticSIEM (ES|QL, KQL, Kibana) for log analysis and detections * Strong Python skills and track record building security tools/automation via APIs * Experience designing automated playbooks in modern SOAR platforms (e.g., Cortex XSOAR, Tines) * Experience with LLM APIs (OpenAI, Anthropic, AWS Bedrock) for security data processing or triage * Knowledge of AWS security services (GuardDuty, CloudTrail, IAM, VPC Flow Logs) * Solid understanding of IR lifecycles (NIST SP 800-61, SANS PICERL); Incident Commander/Handler experience desired * Bonus: CISSP, GCIA, GCIH, or AWS Certified aa
CISSP, - Specialty; Terraform IaC; open-source security contributions Key requirements * paid time off * health insurance * long-term disability * short-term disability * life insurance * Zoox stock appreciation rights / RSUs

## Description

Experteer Overview As a Senior Information Security Engineer at Zoox, you design and operationalize security as code, steering detection engineering and automation. You will architect SIEM-driven detection, SOAR playbooks, and AI-enhanced triage to shorten incident response times. You'll influence how security data is collected, analyzed, and acted upon across cloud and on-prem environments. This is a hands-on, impact-focused role at the intersection of security, automation, and cutting-edge AI." Compensation / Benefits * Design, build, test, and maintain high-fidelity SIEM detections and map them to MITRE ATT&CK for broad visibility * Create automated playbooks in SOAR and develop Python-based tools and REST API integrations to connect security tools * Treat infrastructure and configuration as code to ensure repeatable deployments and consistency * Develop workflows that use LLMs to automatically analyze and contextualize security alerts and speed initial triage * Serve as senior escalation point for security incidents, guiding containment, eradication, and recovery per IR procedures * Monitor and secure AWS and on-prem workloads across multiple operating systems; perform post-incident reviews to drive automated prevention and detections Tasks * 8+ years of information security, security operations, or DevSecOps experience * Deep hands-on experience with Splunk (SPL, Enterprise Security) or ElasticSIEM (ES|QL, KQL, Kibana) for log analysis and detections * Strong Python skills and track record building security tools/automation via APIs * Experience designing automated playbooks in modern SOAR platforms (e.g., Cortex XSOAR, Tines) * Experience with LLM APIs (OpenAI, Anthropic, AWS Bedrock) for security data processing or triage * Knowledge of AWS security services (GuardDuty, CloudTrail, IAM, VPC Flow Logs) * Solid understanding of IR lifecycles (NIST SP 800-61, SANS PICERL); Incident Commander/Handler experience desired * Bonus: CISSP, GCIA, GCIH, or AWS Certified Security - Specialty; Terraform IaC; open-source security contributions Key requirements * paid time off * health insurance * long-term disability * short-term disability * life insurance * Zoox stock appreciation rights / RSUs


## Related Videos

- [Remote Driving on Plant Grounds with State-of-the-Art Cloud Technologies](https://www.wearedevelopers.com/videos/251-remote-driving-on-plant-grounds-with-state-of-the-art-cloud-technologies)
- [Debug a Kubernetes Operator](https://www.wearedevelopers.com/videos/487-debug-a-kubernetes-operator)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Infrastructure as Code: The Developer's Secret Weapon](https://www.wearedevelopers.com/videos/1221-infrastructure-as-code-the-developer-s-secret-weapon)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [Add Location-based Searching to Site with ElasticSearch](https://www.wearedevelopers.com/videos/77-add-location-based-searching-to-site-with-elasticsearch)

## Related Articles

- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)
- [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)
- [Dev Digest 137 - AI'm not sure about this](https://www.wearedevelopers.com/magazine/485-dev-digest-137-ai-m-not-sure-about-this)
- [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers)
- [Dev Digest 166: Sycophancy, Zip bombs and AI Native Development](https://www.wearedevelopers.com/magazine/585-dev-digest-166-sycophancy-zip-bombs-and-ai-native-development)