> Markdown version of [/jobs/ext/2448011-security-operations-engineer](https://www.wearedevelopers.com/jobs/ext/2448011-security-operations-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Operations Engineer

- **Company:** Included Health
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $128,000.0 - $235,000.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Software as a Service, Cloud Computing, Cloud Computing Security, Cloud Storage, Cyber Security, Extract Transform Load (ETL), Data Security, Python (Programming Language), Performance Tuning, Windows PowerShell, Kusto Query Language, Security Information and Event Management, SQL Databases, Software Vulnerability Management, Data Processing, Data Classification, Mttr, Splunk
- **Published:** August 19, 2026
- **Apply:** https://jobs.lever.co/includedhealth/b3b5352c-0784-41c4-9e2f-062461aef44a/apply?lever-origin=applied&lever-source%5B%5D=BuiltInNationwide

## About the Role

* Minimum 5+ years of hands-on experience in security operations, incident response, or security engineering roles, with a strong emphasis on data protection and DLP.
 * Direct, hands-on experience deploying, tuning, and operating
 + DLP tools (endpoint, network, SaaS, and/or cloud)
 + Cloud Access Security Broker (CASB) or similar SaaS security controls in a production environment.
 + DLP signals into SIEM/SOAR workflows (e.g., CrowdStrike, Splunk, Sentinel)
 + Advanced scripting/automation skills (e.g., Python, PowerShell, KQL/SQL) used to enrich, tune, and report on DLP/IR telemetry at scale.
 + Experience designing and maintaining data classification and policy frameworks for PHI, PII, PCI, and other sensitive data types.

## Description

The Senior Security Operations Engineer is responsible for designing, implementing, and improving Data Loss Prevention (DLP) protections across Included Health's corporate and cloud environments. You will lead hands-on deployment and tuning of DLP controls, including endpoint, network, and SaaS. You will investigate and respond to potential data exfiltration events. Additionally, you will drive remediation and hardening based on real-world incidents and detections.

You will own the operational lifecycle of our DLP stack. It involves building and refining policies, partnering with stakeholders to validate business-safe controls, automating response playbooks, and turning signals from alerts and logs into durable security improvements. You will also contribute to adjacent security operations functions, including incident response and vulnerability management, where they intersect with data protection.

You will play a crucial role within the Security Engineering team, reporting directly to the Senior Manager, Security Engineering. This is a remote role., * Lead the response to DLP and data security incidents, including investigation, containment, remediation, and root cause analysis for suspected data exfiltration or improper data handling.

 * Own the deployment, configuration, and continuous tuning of DLP controls across endpoints, network egress, SaaS applications, and cloud storage to protect PHI, PII, PCI, and other sensitive data.
 * Develop and maintain DLP policies, rules, and classifications that balance security, usability, and regulatory/client requirements.
 * Build and refine automated response playbooks and workflows that enrich, triage, and respond to alerts, reducing manual effort and mean time to respond.
 * Perform proactive hunting for anomalous data movement, including unusual destinations, channels, or volumes.
 * Define and track key DLP metrics (coverage, detection quality, MTTD/MTTR, false positive rate) and communicate progress to security leadership and cross-functional partners.


## Related Videos

- [What Developers Get Wrong About Application Quality](https://www.wearedevelopers.com/videos/233-what-developers-get-wrong-about-application-quality)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Startup Presentation: StorX - Future of Cloud Storage](https://www.wearedevelopers.com/videos/1176-startup-presentation-storx-future-of-cloud-storage)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Security Challenges of Breaking A Monolith](https://www.wearedevelopers.com/videos/362-security-challenges-of-breaking-a-monolith)

## Related Articles

- [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology)
- [7 Cloud Computing Trends Coming in 2025 for Developers](https://www.wearedevelopers.com/magazine/412-7-cloud-computing-trends-coming-in-2025-for-developers)
- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)
- [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk)