Cloud Security Operations Engineer

Overview

Full-time, remote Cloud Security Operations Engineer on the Security team, reporting to the Senior Manager, AI Response & Threat. Strengthens the cloud detection and response practice across multi-cloud environments.

What you'll do

• Triage and investigate alerts end-to-end across cloud-native tooling (GuardDuty, Sentinel, Security Command Center), determining severity and scope and closing with documented findings
• Detect and respond to cloud-specific threats, including identity compromise, privilege escalation, access key and token abuse, misconfiguration exploitation, and data exfiltration from cloud storage
• Build detections on cloud audit logs (CloudTrail, Azure Activity and Entra ID logs, GCP Cloud Audit Logs), network flow logs, and container and workload telemetry
• Run proactive threat hunts using ATT&CK-aligned methods, including the Cloud and Containers matrices
• Build automation for cloud containment actions, such as credential revocation, instance isolation, and policy quarantine
• Lead incident response from scoping and containment through post-incident review, performing forensics across cloud, host, network, and memory, and reporting clearly to technical and non-technical stakeholders
• Build, tune, and maintain SIEM correlation rules and Sigma-based detection-as-code pipelines
• Own the health and reliability of the SecOps tooling estate, including SIEM, EDR, SOAR, and log ingestion pipelines, with responsibility for coverage, integration uptime, and vendor escalation
• Participate in the on-call rotation, maintain operational runbooks, and contribute to red and purple team exercises

What you'll need

• 4+ years in security engineering, SOC operations (T2/T3), or incident response within a complex enterprise environment, including 3+ years defending production cloud workloads
• Bachelor's Degree (or equivalent experience) and/or 5 years of related experience
• Strong knowledge of cloud security architecture and telemetry in at least one major provider (AWS, Azure, or GCP), including the log sources needed for detection and investigation
• Deep understanding of cloud IAM and identity-based attack paths, such as role assumption abuse, federation weaknesses, and long-lived credential compromise
• Hands-on experience investigating real cloud incidents using native cloud logs and forensic acquisition methods
• Experience with cloud-native threat detection services and with ingesting and normalizing cloud logs in a SIEM
• Working knowledge of core cloud infrastructure (compute, storage, networking, and serverless) sufficient to assess risk and advise on remediation
• Advanced proficiency with an enterprise SIEM, including detection authoring, correlation rules, pipeline administration, and tuning to reduce false positives at scale
• Working command of MITRE ATT&CK to map detections to technique coverage, identify telemetry gaps, and design hunts against specific adversary behaviors
• Digital forensics experience across host, network, and memory artifacts, including memory acquisition, disk imaging, and multi-source timeline correlation
• Scripting in Python, PowerShell, or Bash, with production automation, log enrichment, or tooling integrations

Nice to have

• CSPM/CNAPP or cloud workload protection experience (Wiz, Prisma Cloud, Defender for Cloud, Orca)
• Experience in multi-cloud environments
• Container and Kubernetes security (EKS, AKS, GKE), including runtime threat detection and image scanning
• IaC for cloud guardrails and security configuration (Terraform, CloudFormation)
• SOAR experience (XSOAR, Splunk SOAR, Torq), including playbook development, API integrations, and case management
• Detection-as-code workflows with CI/CD integration and automated rule validation
• Relevant certifications: GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer

Details

• Full-time, remote role based in Mexico
• May require occasional travel (up to 10-20%) for team meetings, training, or company events