What You’ll Be Responsible for

First Response & Triage: Act as the first responder for security alerts from GuardDuty, dependency advisories, and other detection sources. Assess severity and escalate to the right lead across Platform, Product, Anti-Abuse, or Security.
Customer Security Operations: Own customer security tickets in Front, including account recovery, MFA reset, GitHub-linked account loss, billing-based ownership verification, and org ownership disputes.
Incident Response Support: Participate in the on-call pager rotation alongside other Security Operations Engineers and use documented playbooks to make consistent decisions.
Process Improvement: Maintain and improve runbooks, decision trees, Front macros, and escalation paths. Identify patterns in tickets and alerts to flag opportunities for automation or workflow improvements.
Internal IT Support & Compliance: Triage internal IT requests (access provisioning, SSO/Okta issues, device questions, MDM enrollment) and help maintain access records, joiner-mover-leaver hygiene, and compliance audit trails.
Communication: Communicate clearly with customers, engineers, and internal stakeholders during sensitive or time-critical issues.

Requirements

Prior experience in technical support, IT helpdesk, junior SOC analysis, trust and safety, fraud operations, or a similar triage-heavy environment.
Foundational understanding of security concepts like MFA, JWTs, identity verification, account recovery, and access control.
Foundational understanding of IT systems like SSO, identity providers, Google Workspace, Okta, and MDM tools like Kandji, Jamf, or similar.
Comfortable with a terminal, basic SQL, and reading simple scripts or macros.
Ability to summarize a messy ticket or noisy alert in two sentences that explain what matters and what should happen next.
Strong customer-facing judgment and can stay calm, precise, and firm when handling sensitive access or account issues.
Enjoy turning ambiguous workflows into clear checklists, runbooks, macros, and repeatable systems.
Comfortable working async across time zones and writing things down by default.

Familiarity with Postgres, AWS, or developer tools ecosystems.
Experience with Front, Linear, Notion, Okta, Google Workspace, Kandji, Jamf, Vanta, or similar tools.
Open-source contributions, CTF participation, bug bounty experience, or a personal project that shows security curiosity.
Experience improving support, SOC, trust and safety, fraud, or IT workflows, or basic scripting and automation experience.