Security Operations Engineer

Alchemy

. Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments .

Posted 11/5/2026full-timeUnited StatesMid-LevelSenior💰 $160,000 - $180,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security operations, including detection engineering, threat hunting, and incident response, with a strong focus on automation and AI-assisted tools. Proficient in scripting, log analysis, and cloud security, ensuring effective investigation and remediation across diverse environments.

Highest-signal resume keywords

Security Operations ExperiencePython ScriptingSIEM ExperienceCloud Security KnowledgeIncident Response Skills

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection EngineeringThreat HuntingIncident ResponseLog AnalysisAPIsAutomationDigital ForensicsThreat IntelligenceDetection-As-CodeAI-Assisted Tools

Soft Skills

Clear CommunicationIncident JudgmentMentoringCollaborationProblem-Solving

Tools & Technologies

PantherSplunkAWSKubernetesSOAR WorkflowsLinux SystemsCloud InfrastructureProduction EnvironmentsIdentity ControlsAudit Logging

Industry Keywords

Vulnerability RemediationEndpoint TelemetryNetwork SecurityAttack SimulationBlockchain InfrastructureSensitive Information ProtectionEvidence PreservationIncident Response RotationAlert EnrichmentExposure and Impact Prioritization

Tech Stack

Tools & technologies

AWSCloudKubernetesLinuxPythonSplunk

About the role

Key responsibilities & impact

Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments
Establish what happened from evidence and communicate uncertainty clearly
Build and tune detections, onboard useful telemetry, and maintain reliable log pipelines
Test detection rules against representative attacks and benign activity; address missing coverage and noisy alerts
Participate in the security on-call rotation and incident response, including scoping, containment, recovery, and post-incident improvements
Preserve evidence and coordinate changes with system owners
Automate evidence collection, alert enrichment, investigation timelines, and response preparation
Connect AI agents to approved tools and data sources for bounded tasks with traceable results
Evaluate AI-assisted workflows against known cases and adversarial inputs
Require evidence for conclusions, test false-positive and missed-threat behavior, and maintain human approval for disruptive containment actions
Partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls, and attack-surface monitoring
Prioritize findings by exposure and impact, then verify remediation
Work with platform and product-security partners on controls for agent identities, credentials, tool access, and audit logging
Investigate misuse and build detections for suspicious agent behavior
Share reusable code, investigation skills, runbooks, and evaluation cases
Pair with teammates, review automation, and teach investigation approaches
Track detection coverage, alert quality, investigation effort, response time, and remediation progress
Use defensive outcome measures to determine improvement priorities

Requirements

What you’ll need

Hands-on security operations experience spanning detection engineering, threat hunting, and incident response
Strong scripting and software-building ability, especially Python
Experience with APIs, version control, tests, and operating automation in production
Experience with a SIEM such as Panther, Splunk, or an equivalent platform, including detection logic and log analysis
Working knowledge of cloud security, identity, endpoint telemetry, networking, and Linux systems
Ability to investigate across system boundaries
Evidence of building and using AI-assisted tools in security or adjacent engineering work
Ability to validate outputs, handle failures, and protect sensitive information
Sound incident judgment, including separating hypotheses from findings, preserving evidence, and deciding when to escalate or contain
Record of making teammates more effective through tools, mentoring, code review, or documentation, without management authority
Clear written communication and willingness to own urgent investigations and follow-through
Helpful experience with AWS, Kubernetes, bare-metal infrastructure, detection-as-code, or SOAR workflows
Helpful experience with digital forensics, threat intelligence, or attack simulation
Helpful experience securing AI agents and tool integrations, including prompt injection, credential misuse, and data-exfiltration risks
Helpful experience with blockchain infrastructure or environments with sensitive keys and high-impact production systems

Benefits

Comp & perks

Private Health Insurance
Gym Reimbursement
Commuter Benefits
Flexible Time Off
In-Office Group Meals
Learning & Development Stipend
Company Sponsored Conferences & Events
Books & Audiobook subscription with Bookster
Equity
Bonus