Senior Security Operations Engineer

Fleetio

. Own detection engineering and threat hunting in CrowdStrike Next-Gen SIEM, including log-source onboarding and detection tuning .

Posted 11/4/2026full-timeRemote • United States, Canada, MexicoSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in detection engineering and threat hunting within CrowdStrike Next-Gen SIEM, alongside proficiency in security automation and incident response across cloud and SaaS environments. Strong capabilities in identity security, endpoint security, and data loss prevention are essential.

Highest-signal resume keywords

Detection EngineeringThreat HuntingSecurity AutomationIncident ResponseIdentity Security

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection EngineeringThreat HuntingSecurity AutomationIncident ResponseData Loss PreventionForensicsVulnerability ManagementEndpoint SecurityEmail SecuritySaaS Security Posture Management

Soft Skills

Excellent Written CommunicationExcellent Verbal Communication

Tools & Technologies

CrowdStrike Next-Gen SIEMCrowdStrike FusionOktaMimecastGoogle WorkspacePythonPowerShellREST APIs

Certifications & Qualifications

SOC 2ISO 27001

Industry Keywords

Security OperationsDetection and ResponseSecurity EngineeringSaaSIncident Command

Tech Stack

Tools & technologies

CloudMacOSPython

About the role

Key responsibilities & impact

Own detection engineering and threat hunting in CrowdStrike Next-Gen SIEM, including log-source onboarding and detection tuning
Build security automation and SOAR workflows connecting identity, endpoint, email, and SaaS tools
Use AI agents and automated workflows for triage, investigation, enrichment, and response
Lead corporate incident response as technical lead, including third-party and supply-chain events
Run forensics, determine root cause, communicate guidance to leaders and employees, and maintain incident runbooks
Serve in the escalation rotation and back up the Incident Commander when needed
Own CrowdStrike Falcon configuration, detections, device trust checks, software inventory, and Falcon Complete escalations
Own Okta authentication, MFA, session policy, privileged access management, access reviews, and audit evidence automation
Manage Mimecast, secure network access, Google Workspace, key SaaS security settings, and SaaS security posture findings
Own data loss prevention across email, Google Workspace, endpoints, and SaaS applications
Own security for Fleetio’s AI usage, including AI-tool visibility, agent identity and access, guardrails, and AI detection and response
Run vulnerability management for corporate assets and report clear security-posture metrics
Collaborate with IT Operations, Compliance, the third-party SOC, and Product Security

Requirements

What you’ll need

5+ years of experience in security operations, detection and response, or security engineering, ideally at a SaaS company
Detection engineering and threat hunting in a SIEM (CrowdStrike Next-Gen SIEM or similar)
Security automation: building SOAR playbooks (CrowdStrike Fusion or similar) that connect identity, endpoint, email, and SaaS tools into a single response flow, with Python or PowerShell and REST APIs
Incident response from first triage through forensics, root cause, and follow-up across cloud, identity, and SaaS environments, including working with an MDR or managed SOC provider
Identity security with Okta or a similar provider: authentication policy, privileged access, and access reviews in a SOC 2 or ISO 27001 control environment
Endpoint security with CrowdStrike or similar, including macOS, plus device trust and endpoint query tooling
Email security (Mimecast or similar) and SaaS security posture management
Designing and running a DLP program: data classification, policy design and tuning across email, cloud collaboration, and endpoints, and investigating data exposure
Securing developer tooling and the software supply chain (IDE extensions, package registries, AI coding tools)
Excellent written and verbal communication skills, including explaining risk to non-technical leaders

Benefits

Comp & perks

Multiple health/dental coverage options (100% coverage for employee, 50% for family)
Vision insurance
Incentive stock options
401(k) match of 4%
PTO - 4 weeks (increases at year two!)
12 company holidays + 2 floating holidays
Parental leave - birthing parent (16 weeks paid) non-birthing (4 weeks paid)
FSA & HSA options
Short and long term disability (short term 100% paid)
Community service funds
Professional development funds
Wellbeing fund - $150 quarterly
Business expense stipend - $125 quarterly
Mac laptop + new hire equipment stipend
Fully stocked kitchen with tons of drinks & snacks (BHM only)
Remote working friendly since 2012