Staff Security Operations Engineer

Overview

Staff Security Operations Engineer on Gainsight's Security team, reporting to the Senior Manager, AI Response & Threat. The role drives strategy, engineering and operational maturity of the security operations program.

What you'll do

• Own complex or high-severity incidents end-to-end, from initial triage through containment, remediation and post-incident review, keeping stakeholders informed throughout.
• Staff incident response for significant security events, from scoping and containment through post-incident review.
• Conduct host, network and memory forensics and produce clear, accurate reporting for technical and non-technical stakeholders.
• Work closely with DevOps and Engineering to embed security controls into infrastructure, CI/CD pipelines and system design.
• Develop the skills and judgment of analysts and engineers so the broader group operates with greater independence and technical depth.
• Translate complex technical findings into clear, actionable insight for executive leadership, customers and non-technical stakeholders, especially during an active incident.
• Assess, select and integrate security tools (SIEM, EDR, SOAR, cloud-native platforms) to improve coverage without unnecessary complexity or cost.

What you'll need

• 6+ years of experience in security operations, with progressive responsibility across triage, incident response and detection engineering.
• Proven experience leading or mentoring a team, formally or informally, including technical guidance and coaching.
• Deep expertise with SIEM, EDR and SOAR platforms, including hands-on rule-writing, tuning and automation development.
• Strong incident response leadership experience, including managing complex or high-severity incidents end-to-end.
• Solid understanding of cloud security architecture (AWS, Azure or GCP) and experience working with DevOps and Engineering to embed security into CI/CD pipelines and infrastructure.
• Scripting or automation proficiency (Python, PowerShell or similar) to build and scale response workflows.
• Deep familiarity with attacker tactics and techniques (MITRE ATT&CK) and how to translate them into detection logic.
• Excellent communication skills, with the ability to brief executives and technical teams alike during incidents and planning discussions.

Nice to have

• Hands-on experience with cloud-native detection and posture tools (e.g., AWS GuardDuty, Azure Sentinel, Wiz, Prisma Cloud).
• Familiarity with container and orchestration security (Docker, Kubernetes) and associated attack surfaces.
• Experience with threat intelligence platforms and proactive threat hunting using MITRE ATT&CK or Sigma rules.
• Exposure to purple team or adversary simulation exercises (e.g., Atomic Red Team, Caldera) to validate detection coverage.
• Relevant certifications (e.g., GCIH, GCFA, GCTI, CISSP, OSCP).
• Working knowledge of network security architecture, including segmentation, zero trust principles and cloud network security groups.
• Experience with vulnerability management programs, including scanning, prioritization and remediation tracking.
• Experience working with data loss prevention (DLP) tools and insider threat detection.

Details

• Full-time, hybrid role based in Hyderabad, India.
• Occasional travel of up to 10-20% for team meetings, training or company events.