Security Operations Engineer

What You’ll Be Responsible for

• First Response & Triage: Act as the first responder for security alerts from GuardDuty, dependency advisories, and other detection sources. Assess severity and escalate to the right lead across Platform, Product, Anti-Abuse, or Security.
• Customer Security Operations: Own customer security tickets in Front, including account recovery, MFA reset, GitHub-linked account loss, billing-based ownership verification, and org ownership disputes.
• Incident Response Support: Participate in the on-call pager rotation alongside other Security Operations Engineers and use documented playbooks to make consistent decisions.
• Process Improvement: Maintain and improve runbooks, decision trees, Front macros, and escalation paths. Identify patterns in tickets and alerts to flag opportunities for automation or workflow improvements.
• Internal IT Support & Compliance: Triage internal IT requests (access provisioning, SSO/Okta issues, device questions, MDM enrollment) and help maintain access records, joiner-mover-leaver hygiene, and compliance audit trails.
• Communication: Communicate clearly with customers, engineers, and internal stakeholders during sensitive or time-critical issues.

Requirements

• Prior experience in technical support, IT helpdesk, junior SOC analysis, trust and safety, fraud operations, or a similar triage-heavy environment.
• Foundational understanding of security concepts like MFA, JWTs, identity verification, account recovery, and access control.
• Foundational understanding of IT systems like SSO, identity providers, Google Workspace, Okta, and MDM tools like Kandji, Jamf, or similar.
• Comfortable with a terminal, basic SQL, and reading simple scripts or macros.
• Ability to summarize a messy ticket or noisy alert in two sentences that explain what matters and what should happen next.
• Strong customer-facing judgment and can stay calm, precise, and firm when handling sensitive access or account issues.
• Enjoy turning ambiguous workflows into clear checklists, runbooks, macros, and repeatable systems.
• Comfortable working async across time zones and writing things down by default.

Nice to Have

• Familiarity with Postgres, AWS, or developer tools ecosystems.
• Experience with Front, Linear, Notion, Okta, Google Workspace, Kandji, Jamf, Vanta, or similar tools.
• Open-source contributions, CTF participation, bug bounty experience, or a personal project that shows security curiosity.
• Experience improving support, SOC, trust and safety, fraud, or IT workflows, or basic scripting and automation experience.