Security Engineer I

The Staff Engineer, Cybersecurity is responsible for supporting day-to-day cybersecurity operations while helping improve team efficiency through targeted automation initiatives. Working within a small cybersecurity team, this individual will serve as a primary resource for operational ticket handling, security investigations, user requests, and security process execution.

The role requires developing a deep understanding of existing cybersecurity workflows, technologies, and business processes. While the primary focus is executing and managing operational work, the Staff Engineer will also identify opportunities to automate repetitive tasks and leverage SOAR and workflow automation platforms to improve consistency, reduce manual effort, and increase operational efficiency.

Success in this role will be measured by operational excellence, ticket quality, responsiveness, and the ability to incrementally reduce manual workload through practical automation.

Essential Duties and Responsibilities

Cybersecurity Operations (80%)

Operational Ticket Management

• · Manage and resolve cybersecurity-related tickets and service requests.
• · Perform triage, investigation, escalation, and resolution activities in accordance with established procedures.
• · Ensure timely responses to operational requests and security events.
• · Document investigations, findings, and remediation actions within ticketing systems.
• · Maintain awareness of ticket queues and ensure service levels are met.

Security Investigations

• · Investigate suspicious activity, security alerts, and user-reported concerns.
• · Perform account compromise, phishing, identity, endpoint, and access-related investigations.
• · Gather and analyze evidence from security tools and platforms.
• · Escalate complex incidents when appropriate.
• · Support incident response activities during security events.

Operational Process Execution

• · Execute established security procedures and playbooks.
• · Support user access reviews, security assessments, and operational security tasks.
• · Coordinate with IT and business stakeholders to resolve operational issues.
• · Maintain accurate operational documentation and procedures.
• · Identify recurring issues and recommend process improvements.

Security Platform Operations

• · Utilize security tools to investigate and respond to operational events.
• · Support monitoring and administration of cybersecurity technologies.
• · Validate security alerts and determine appropriate actions.
• · Assist with security control testing and operational validation activities.

Automation and Continuous Improvement (20%)

Workflow Automation

• · Identify repetitive and time-consuming operational tasks suitable for automation.
• · Develop, test, and maintain SOAR workflows and automation playbooks.
• · Improve consistency and repeatability of operational procedures.

Process Optimization

• · Analyze ticket trends and operational metrics.
• · Recommend improvements that reduce manual effort and increase efficiency.
• · Develop documentation for automated workflows and processes.
• · Measure automation effectiveness and operational benefits.

• · Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related discipline; or equivalent combination of education and experience., * · 5+ years of experience in cybersecurity operations, incident response, security engineering, or a related field.
• · 5+ years of experience investigating cybersecurity events and security alerts.
• · 5+ years of experience working within a ticket-driven operational environment.
• · 5+ years of experience supporting security technologies and operational processes.
• · 2+ years of experience with scripting, automation, or workflow orchestration platforms preferred.

Technical Skills

Experience with all of the following:

• · Security Operations Center (SOC) processes
• · Incident Response
• · Identity and Access Management
• · Microsoft 365 Security
• · Okta
• · Endpoint Detection and Response (EDR/XDR)
• · SIEM platforms
• · Email Security
• · Cloud Security (Azure/AWS)
• · ServiceNow, Jira, or similar ticketing platforms
• · Security investigation and threat analysis
• · SOAR platforms such as Tines, Cortex XSOAR, Splunk SOAR, or Microsoft Sentinel Automation
• · PowerShell, Python, JavaScript, or similar scripting languages

Key Performance Indicators

• · Timely handling and resolution of operational tickets.
• · Quality and completeness of investigations.
• · Adherence to operational procedures and service levels.
• · Reduction in manual effort through automation.
• · Number and effectiveness of implemented workflow improvements.
• · Accuracy and quality of documentation.
• · Contribution to overall team efficiency and scalability.

Characteristics of a Successful Candidate

• · Strong operational mindset with attention to detail.
• · Comfortable managing a high volume of tickets and investigations.
• · Naturally curious and investigative.
• · Able to independently prioritize and execute work.
• · Process-oriented and focused on continuous improvement.
• · Practical experience automating repetitive tasks.
• · Effective collaborator in a small, fast-moving team environment.