Security Operations

• Own the daily operation and continuous improvement of Alpaca’s SIEM and SOAR capabilities
• Onboard security logs across cloud, identity, endpoint, SaaS, and application systems, including parsing, normalization, and data quality checks
• Build, test, and tune detection rules based on threat intelligence, incident learnings, and emerging attack techniques, mapped to frameworks such as MITRE ATT&CK
• Tune, enrich, and manage the lifecycle of detections so alerts stay actionable
• Maintain detections for critical systems and priority attack techniques
• Build and maintain dashboards for alert volume, ingest health, and response status
• Support security incidents with evidence collection, detection queries, and containment actions
• Develop and improve alert-handling and incident response runbooks and escalation paths
• Track and report security operations metrics, including MTTD and MTTR
• Participate in the Security Operations on-call rotation after onboarding and cross-training
• Design, build, and maintain SOAR playbooks automating enrichment, containment, ticketing, and notification
• Triage, investigate, and respond to security alerts across endpoints, identity, cloud, network, and application logs
• Run hypothesis-driven threat hunts and turn findings into new detections
• Report to the Enterprise Security Architect and collaborate with Security, IT, DevOps, Engineering, and external partners

Explore Security Operations Engineer at Alpaca. Review requirements and application details.