Lead security incidents end-to-end: triage, containment, eradication, recovery, stakeholder communication and post-incident review.

Own and evolve our incident response process: playbooks, severity model, on-call practices and tabletop exercises with engineering and IT.

Build and tune detections in Datadog Cloud SIEM across AWS, Kubernetes and Google Workspace to reduce time to detect and alert noise.

Investigate suspicious activity across cloud, identity and workload logs, collecting and preserving evidence for follow-up.

Improve our cloud security posture, including IAM, and turn findings into prioritized, tracked work for engineering squads.

Automate detection and response tasks with Python and Terraform.

Report on incidents and security posture to engineering leadership, and mentor engineers across squads.

5+ years of experience in Blue team / Defensive security / Security operations.

Hands-on experience leading security incident response, from detection through post-incident review and follow-up of actions.

Experience with forensics and evidence handling in cloud environments: log analysis, evidence collection and preservation.

Experience building and tuning SIEM detections and alerts, such as in Datadog Cloud SIEM, mapped to MITRE ATT&CK, CIS or NIST.

Experience securing AWS and Kubernetes, including AWS IAM and SSO permission reviews and remediation.

Automating security tasks with Python and/or Bash, and managing infrastructure as code with Terraform.

Experience defining security processes, leading cross-team initiatives and mentoring engineers, with fluent English for daily work with native speakers.

Lead security incidents end-to-end: triage, containment, eradication, recovery, stakeholder communication and post-incident review.

Own and evolve our incident response process: playbooks, severity model, on-call practices and tabletop exercises with engineering and IT.

Build and tune detections in Datadog Cloud SIEM across AWS, Kubernetes and Google Workspace to reduce time to detect and alert noise.

Investigate suspicious activity across cloud, identity and workload logs, collecting and preserving evidence for follow-up.

Improve our cloud security posture, including IAM, and turn findings into prioritized, tracked work for engineering squads.

Automate detection and response tasks with Python and Terraform.

Report on incidents and security posture to engineering leadership, and mentor engineers across squads.

5+ years of experience in Blue team / Defensive security / Security operations.

Hands-on experience leading security incident response, from detection through post-incident review and follow-up of actions.

Experience with forensics and evidence handling in cloud environments: log analysis, evidence collection and preservation.

Experience building and tuning SIEM detections and alerts, such as in Datadog Cloud SIEM, mapped to MITRE ATT&CK, CIS or NIST.

Experience securing AWS and Kubernetes, including AWS IAM and SSO permission reviews and remediation.

Automating security tasks with Python and/or Bash, and managing infrastructure as code with Terraform.

Experience defining security processes, leading cross-team initiatives and mentoring engineers, with fluent English for daily work with native speakers.