Security Operations Engineer

Overview

Alpaca is seeking a Security Operations Engineer to own the daily operation and continuous improvement of its SIEM and SOAR capabilities, reporting to the Enterprise Security Architect.

What you'll do

• Onboard new security log sources across cloud, identity, endpoint, SaaS, and application systems, including parsing, normalization, and data quality checks.
• Build, test, and tune detection rules based on threat intelligence, incident learnings, and emerging attack techniques, mapped to frameworks such as MITRE ATT&CK.
• Tune, enrich, and manage the lifecycle of detections so alerts stay actionable.
• Maintain detections for critical systems and priority attack techniques.
• Build and maintain dashboards for alert volume, ingest health, and response status.
• Support security incidents with evidence collection, detection queries, and containment actions, working with IT, Engineering, and external partners.
• Develop and improve alert-handling and incident response runbooks and escalation paths.
• Track and report security operations metrics, including mean time to detect (MTTD) and mean time to respond (MTTR).
• Participate in the Security Operations on-call rotation after onboarding and cross-training.
• Design, build, and maintain SOAR playbooks that automate repeatable response actions, including enrichment, containment, ticketing, and notification.
• Triage, investigate, and respond to security alerts across endpoints, identity, cloud, network, and application logs.
• Run hypothesis-driven hunts based on threat intelligence and incident learnings, and turn findings into new detections.

What you'll need

• Excited about Alpaca's mission and what we're building.
• 3+ years of experience in Security Operations or detection engineering roles.
• Hands-on experience operating and tuning a SIEM.
• Experience building SOAR playbooks or equivalent response automation.
• Working with Linux.
• Scripting or automation experience (Python, Bash) for security operations tasks.
• Experience onboarding and parsing log sources from cloud, identity, and SaaS platforms.
• Strong alert investigation skills across identity, endpoint, network, and cloud environments.
• Understanding of common attacker techniques and detection methodologies.
• Experience supporting security incidents, including evidence collection, detection queries, and containment.
• Willing to participate in an on-call rotation.
• Strong written and verbal communication skills, especially during incidents.
• Comfortable working cross-functionally and handling escalations calmly and decisively.

Nice to have

• Experience securing financial, trading, or other highly regulated platforms.
• Familiarity with compliance frameworks such as SOC 2 or ISO 27001.
• Experience with detection-as-code, GitOps, and CI/CD pipelines.
• Knowledge of cloud security logging (AWS/GCP/Azure) and SaaS security telemetry.
• Familiarity with Kubernetes-hosted security tooling.
• Experience working with a managed SOC or MSSP.
• Security certifications (GCIA, GCIH, GCED, or similar).
• Ability to balance security rigor with operational efficiency and business needs.

Details

• Remote, Americas.
• The Security Team is 100% distributed and remote.
• Participation in an on-call rotation.