Sr. Security Engineer (Detection)
Solace · Remote · United States ·
COMPENSATION
$150k – $200k
Listed on the employer's job board (Ashby)
- Senior Security Engineer
- Fully remote (US)
- Datadog Cloud SIEM
- Incident Response focus
- HIPAA regulated
Join Solace as a Senior Security Engineer to own the detection and alerting program end-to-end. You will transform telemetry from identity, cloud, and SaaS stacks into high-signal detections while reducing noise and improving response times.
This hands-on position operates within a HIPAA-regulated environment. You will collaborate with application and infrastructure security engineers to build the foundation of security operations, ensuring rapid identification and response to real threats.
What you'll do
- Own Datadog Cloud SIEM including log pipelines, parsing, enrichment, and cost management
- Build and tune detection rules across identity, cloud, endpoint, and SaaS environments
- Reduce alert noise and improve fidelity, triage time, and false-positive rates
- Map detection coverage to MITRE ATT&CK and close high-risk gaps
- Manage detection-as-code with version control, testing, and peer reviews
- Serve as primary responder for security alerts, handling triage and containment
- Develop automation for triage, enrichment, and workflow acceleration
- Contribute to cloud hardening, IAM improvements, and audit evidence gathering
What you'll need
- 3–6 years in security operations, detection engineering, or incident response
- Experience building and tuning detections in a SIEM, preferably Datadog
- Ability to read and correlate logs from cloud, identity, and SaaS platforms
- Hands-on incident response experience including triage and post-mortems
- Scripting skills in Python or similar for automation and analysis
- Strong understanding of attack patterns like phishing and cloud misconfigurations
- Comfortable building from scratch in ambiguous startup environments
- Must be based in the United States
Nice to have
- Experience in healthcare or regulated environments like HIPAA or SOC 2
- Familiarity with detection-as-code workflows using Terraform or CI/CD
- Experience with SOAR tools such as Tines or Windmill
- Security operations knowledge of Okta, Jamf, Snowflake, GitHub, or Vanta
- Threat hunting experience or contributions to open-source detection content
Stack
- Datadog Cloud SIEM
- AWS
- GCP
- Okta
- Google Workspace
- Jamf
- Snowflake
- GitHub
- Slack
- Python
How you'll work
- Fully remote within the United States
- Participate in on-call rotation as the team grows
- Small, lean, and mission-driven team structure