Security Operations Engineer

TrueCommerce

. Lead security investigations and incident response from initial assessment through containment, recovery, and closure .

Posted 11/12/2026full-timeRemote • United StatesMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security operations and incident response, with a strong focus on endpoint vulnerability management, remediation coordination, and effective communication of technical findings. Proficient in analyzing endpoint telemetry and utilizing security tools to enhance organizational security posture.

Highest-signal resume keywords

Incident Response CoordinationEndpoint Vulnerability ManagementMicrosoft Defender for EndpointPalo Alto Cortex XDRPowerShell Scripting

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security OperationsIncident ResponseEndpoint AdministrationWindows TroubleshootingEndpoint Telemetry AnalysisKQLPython ScriptingBash ScriptingChange ManagementVulnerability Assessment

Soft Skills

Clear Written CommunicationCollaboration Across TeamsPrioritization of Competing Demands

Tools & Technologies

Microsoft DefenderPalo Alto Cortex XDRSIEM PlatformIntuneExchange Online

Certifications & Qualifications

SC-200GCIHGCFA

Industry Keywords

Security EngineeringCloud SecuritySaaS Security OperationsEndpoint ManagementThreat Hunting

Tech Stack

Tools & technologies

CloudLinuxMacOSPython

About the role

Key responsibilities & impact

Lead security investigations and incident response from initial assessment through containment, recovery, and closure
Analyze endpoint telemetry, authentication activity, process execution, network connections, and other evidence
Perform authorized response actions and coordinate remediation with system owners
Escalate high-severity incidents and significant business or customer-impact decisions to Information Security leadership
Maintain investigation timelines, evidence, response decisions, and stakeholder updates
Complete post-incident reviews and track corrective actions through closure
Triage and resolve security tickets from Microsoft Defender, Palo Alto Cortex XDR, vulnerability assessments, employee reports, and internal escalations
Validate findings, assess risk, distinguish malicious activity from benign behavior, and determine next steps
Remediate findings directly within authorized access and change-control boundaries
Provide actionable guidance, establish ownership, track progress, and verify completion when other teams implement fixes
Document investigation results, remediation evidence, and closure rationale
Identify recurring issues and implement durable improvements
Own endpoint vulnerability management, including prioritization, remediation coordination, exception tracking, and verification
Maintain visibility into assessment coverage, missing or unhealthy agents, unsupported software, and unmanaged or stale devices
Prioritize vulnerabilities using severity, exploitability, exposure, and business criticality
Coordinate patch deployment and system changes with IT and infrastructure teams
Track remediation against service-level targets and escalate overdue high-risk findings
Validate fixes through reassessment or other technical evidence
Maintain documented, approved, time-bound exceptions
Report coverage gaps, overdue exposure, remediation progress, and recurring obstacles
Maintain and troubleshoot endpoint security policies, agent health, coverage, and integrations
Tune detections and recommend exclusions through documented review and approval
Develop scripts, investigation queries, dashboards, and integrations to reduce manual work
Apply secure engineering practices, including least privilege, protected credentials, logging, testing, and safeguards for disruptive actions
Maintain response playbooks, technical documentation, and operational handoffs
Support targeted threat hunting and security engineering improvements
Partner with technical teams across a global business to implement security improvements accounting for availability and customer impact
Coordinate disruptive containment and remediation through incident and change management processes
Communicate technical findings to technical and nontechnical stakeholders
Participate in a shared on-call rotation with defined escalation paths and backup coverage

Requirements

What you’ll need

Four+ years of relevant experience in one or more of: security operations, incident response, and/or security engineering
Demonstrated ability to independently investigate security incidents and coordinate response through resolution
Experience investigating Entra ID sign-in activity, Conditional Access, Intune-managed devices, and Exchange Online email threats
Hands-on production experience with Microsoft Defender for Endpoint or Palo Alto Cortex XDR, with the ability to become proficient in both
Experience driving endpoint vulnerability remediation, including prioritization, patch coordination, tracking, and verification
Strong Windows troubleshooting skills and working knowledge of endpoint administration, identity security, and networking
Ability to interpret endpoint telemetry, process trees, authentication events, and operating-system logs
Experience managing findings through a ticketing or security case-management system
Practical scripting skills in PowerShell, Python, or Bash
Clear written communication and the ability to provide actionable remediation guidance
Ability to prioritize competing demands and collaborate with teams across time zones
Preferred: Production experience with both Microsoft Defender and Palo Alto Cortex XDR
Preferred: Experience with KQL, Cortex XDR query capabilities, or a SIEM platform
Preferred: Familiarity with endpoint management and patch-deployment tools
Preferred: Experience investigating or securing Linux or macOS systems
Preferred: Security operations experience in SaaS or another availability-sensitive environment
Preferred: Familiarity with cloud security logs and investigations
Preferred: Familiarity with EDI, managed file transfer, AS2, SFTP, APIs, or certificate management
Preferred: Relevant certifications (e.g. SC-200, GCIH, GCFA) or equivalent practical experience
Must be authorized to work for any employer in the U.S.
Employment visa sponsorship is unavailable

Benefits

Comp & perks

Remote first and casual work environment
401k with 3.5% company match and vested after 2 years
20 PTO days
10 company holidays
1 birthday day off
1 Volunteer day
3 summer days
Medical, dental, vision and other life/health insurance plans
Paid parental leave
Wellness reimbursement program
Career development
Recognition programs