> Markdown version of [/jobs/ext/4445926-security-operations-engineer](https://www.wearedevelopers.com/jobs/ext/4445926-security-operations-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Operations Engineer

- **Company:** COLLECTORS L.L.C.
- **Location:** Jersey City, NJ, United States (Remote available)
- **Experience:** Experienced
- **Salary:** $140,971.0 - $228,870.0
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Amazon Elastic Compute Cloud, Microsoft Azure, Software as a Service, Cloud Engineering, Cyber Security, Database Queries, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Security Information and Event Management, Systems Integration, Okta, Mitre Att&ck, Build Management, Containerization, Script Language, Cybercrime, Data Pipelines, Security Orchestration, Automation & Response
- **Published:** October 15, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=5fe7ef9a8056554e

## About the Role

* 5+ years in security operations, incident response, or detection engineering, with at least 2 years operating in a cloud-native environment at a senior level.
 * Deep hands-on experience securing AWS at scale (IAM, CloudTrail, GuardDuty, Security Hub, EC2/EKS/Lambda) in a multi-account organization; familiarity with GCP or Azure is a plus.
 * Strong SIEM proficiency - you've built and tuned detections, written complex queries, and managed log pipelines, not just consumed alerts.
 * Proficiency in one or more general purpose programming/script languages, preferably Python, and comfortable building automation, integrations, and SOAR playbooks from scratch.
 * A seasoned incident responder who stays calm under pressure, communicates clearly with technical and executive audiences, and leads without needing formal authority.
 * Grounded in attacker tradecraft - you think in terms of MITRE ATT&CK, understand cloud-specific attack paths, and use that lens to prioritize work.
 * Experienced working across team boundaries: influencing engineering roadmaps, negotiating with vendors, and representing security operations in cross-functional forums.
 * Pragmatic and outcome-driven - you balance ideal security posture against operational reality and know when good enough today beats perfect next quarter.
 * Excellent problem-solving skills, with the ability to work independently and handle multiple tasks Familiarity with major compliance frameworks, such as PCI, NIST, ISO, SOX, and experience assisting in audits
*, Candidates must be authorized to work in the United States.

Collectors uses e-Verify to validate your ability to work legally in the United States.

## Description

* Drive Detection Engineering: Build, tune and manage high-confidence detections across cloud platforms (AWS/GCP), enterprise tooling (Okta, GWS, M365) and vendor products. Treat detections as code: version controlled, peer reviewed, tested in CI, and measured for precision and coverage against MITRE ATT&CK.
 * Incident Command and Containment: Serve as a senior responder for security incidents, driving triage, containment, forensics, and remediation, and authoring post-incident reviews that turn lessons into durable improvements.
 * Threat Hunting: Conduct proactive threat hunts across cloud, SaaS, identity and on-prem infrastructure, converting hypotheses and findings into new detections and hardened controls.
 * Tooling and Response Automation: Design and build automation and SOAR playbooks that reduce manual toil, accelerate response times, and improve alert enrichment and case management.
 * Security Telemetry : Own and improve the health of the security data pipeline: log source onboarding, parser and schema quality, coverage gap analysis, and data quality for data sources across our cloud, SaaS and on-prem environment.
 * Automated Analysis and Secure Frameworks: Scale security efforts by integrating automation for the identification, prioritization, and remediation of vulnerabilities
 * Partner cross-functionally with infrastructure, platform, and engineering teams to embed security operations requirements into new services and cloud architecture decisions.
 * Lead by example and be a champion of all company policies, including safety, attendance & security Participate in a shared on-call rotation, and continuously improve runbooks, escalation paths, and alert quality to make on-call sustainable for the whole team.
*, U.S. residents: for disclosures relating to personal information we collect during the employment application and recruitment process, please see our Privacy Notice for U.S. Applicants .