Security Operations Lead
Build and lead Fireworks AI’s security operations function, owning detection engineering, incident response, threat intelligence, and SecOps workflows. The role requires 7+ years of security experience, hands-on EDR and cloud security expertise, strong Python automation skills, and the ability to grow an IC function into a team.
About the job
Responsibilities
- Lead the rollout, tuning, and ongoing operation of CrowdStrike across endpoint and cloud environments, including SIEM use cases.
- Define and operate detection and response programs, including detection content, triage and escalation workflows, and MITRE ATT&CK coverage measurement.
- Own incident response from triage through executive communication, post-incident reviews, and lessons learned.
- Establish security operations workflows, including SOAR automation, alerting, on-call, incident orchestration, IT ticket triage, SLAs, and metrics.
- Build a threat intelligence capability focused on AI infrastructure and customers, translating intelligence into detections, hardening, and tabletop scenarios.
- Partner with Infrastructure, Corporate Security, IT, Security Engineering, and other cross-functional teams.
- Hire and develop the SecOps team as the function matures, potentially expanding into 24x7 coverage, cloud detection engineering, insider threat, and red/purple team operations.
Requirements
- 7+ years of experience in security operations, detection and response, incident response, or a related field.
- Hands-on EDR experience, preferably CrowdStrike, including detection engineering and tuning.
- Strong experience writing, testing, and maintaining detection content at scale.
- Demonstrated leadership of real incident responses from triage through executive communication and post-incident review.
- Strong scripting and automation skills, including Python and SOAR platforms.
- Working knowledge of cloud security operations across AWS, GCP, or Azure.
- Experience building or significantly maturing a SecOps function, including tooling selection, process design, and metrics.
- Ability to operate hands-on in a build-phase environment.
Nice to Have
- SIEM detection engineering at scale with CrowdStrike Falcon LogScale/NG-SIEM, Splunk, Sumo Logic, Panther, or similar tools.
- Experience with Incident.io, PagerDuty, or comparable incident management tools.
- Threat intelligence experience, including operationalizing intelligence into detection and hardening outcomes.
- Experience at an AI, cloud infrastructure, or high-growth SaaS company.
- Certifications such as GCIA, GCIH, GCFA, or OSCP.
Compensation & Benefits
- Salary range: $180,000–$210,000.
- Work on AI infrastructure and scalable model serving with a collaborative team of engineers and AI researchers.
Skills
Crowdstrike, SIEM, Edr, Detection Engineering, Incident Response, Python, Soar, AWS, GCP, Azure, Mitre Att&Ck, Threat Intelligence, Incident.Io, Pagerduty, Splunk
Similar jobs
Security Engineering jobs
Monarch
Remote
Own and scale security governance, risk, compliance, and customer assurance programs, including audits, controls monitoring, third-party risk, policies, and security questionnaires. The role requires 3–5 years of security GRC experience and hands-on understanding of IAM, endpoint, and cloud controls.
Valon
United States
Leads offensive security, threat intelligence, security testing, and incident response across applications, infrastructure, and networks. The role requires at least five years of relevant experience, cloud security expertise, AI and automation experience, and a bachelor's degree.
Anyscale
IndiaOwn Anyscale’s secure software development lifecycle, partner with engineering on secure architecture and features, and lead vulnerability management and remediation. The role requires 8+ years of product or application security experience and strong hands-on secure-development expertise.
Anyscale
San Francisco, CA
Own Anyscale’s compliance function end to end, leading SOC 2 and ISO 27001 programs, audit readiness, customer security diligence, and enterprise risk management. The role requires 7+ years in governance, risk, and compliance plus strong cloud and SaaS security-controls expertise.
Siftstack
Marina Del Rey, CA
The Senior Application Security Engineer will build secure-by-default software patterns, supply-chain controls, and developer-facing security tooling across a distributed systems platform. The role requires 5+ years of production software experience, strong application security expertise, and depth in Go or Rust.