{"version":"0.1","company":{"name":"YubHub","url":"https://yubhub.co","jobsUrl":"https://yubhub.co/jobs/skill/investigation-workflows"},"x-facet":{"type":"skill","slug":"investigation-workflows","display":"Investigation Workflows","count":3},"x-feed-size-limit":100,"x-feed-sort":"enriched_at desc","x-feed-notice":"This feed contains at most 100 jobs (the most recently enriched). For the full corpus, use the paginated /stats/by-facet endpoint or /search.","x-generator":"yubhub-xml-generator","x-rights":"Free to redistribute with attribution: \"Data by YubHub (https://yubhub.co)\"","x-schema":"Each entry in `jobs` follows https://schema.org/JobPosting. YubHub-native raw fields carry `x-` prefix.","jobs":[{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_740da2af-174"},"title":"Security Engineer, Detection & Response","description":"<p>We are seeking a Senior Security Engineer with a specialty in Detection and Incident Response to join our Security Engineering team. This role sits at the intersection of security operations and software engineering, requiring you to investigate incidents and build the systems that detect, contain, and prevent them.</p>\n<p>You will design and ship high-precision detections across cloud services and enterprise SaaS, develop automation that shortens response timelines, and mature the telemetry pipelines that make it all possible. Your ability to write production-quality code is just as important as your ability to triage an alert.</p>\n<p>Responsibilities:</p>\n<ul>\n<li>Engineer, test, and deploy detection logic across cloud and enterprise environments, treating detections as software with version control, peer review, and measurable performance.</li>\n</ul>\n<ul>\n<li>Build and maintain incident response automation, runbooks, and tooling that reduce containment timelines without sacrificing developer velocity.</li>\n</ul>\n<ul>\n<li>Mature telemetry pipelines through improved schema design, normalization, enrichment, and quality checks that reduce false positives and increase signal fidelity.</li>\n</ul>\n<ul>\n<li>Perform digital incident investigations to identify and contain potential security breaches.</li>\n</ul>\n<ul>\n<li>Conduct digital forensics and malware analysis to understand attack vectors and adversary methodologies.</li>\n</ul>\n<ul>\n<li>Integrate alerting with messaging and ticketing systems to enable fast, traceable response workflows.</li>\n</ul>\n<ul>\n<li>Partner cross-functionally with IT, security, and engineering teams to harden identity and access patterns, close logging and forensics gaps, and implement maintainable guardrails that scale with the organisation.</li>\n</ul>\n<ul>\n<li>Utilize threat intelligence platforms to improve hunting, detection, and response workflows.</li>\n</ul>\n<ul>\n<li>Clearly explain the significance and impact of incidents, providing actionable recommendations to both technical and non-technical stakeholders.</li>\n</ul>\n<p>Ideal Candidate:</p>\n<ul>\n<li>5+ years of experience in Detection Engineering, Incident Response, or Security Operations, with a strong emphasis on building and shipping security tooling and automation.</li>\n</ul>\n<ul>\n<li>Proficiency in at least one programming language (e.g., Python, Go) and comfort writing production-grade code , not just scripts.</li>\n</ul>\n<ul>\n<li>Hands-on experience designing or improving detection pipelines, SIEM content, and alerting workflows in cloud-native environments.</li>\n</ul>\n<ul>\n<li>Practical experience with SIEM, EDR, and SOAR tools, with a preference for candidates who have built integrations or extended these platforms programmatically.</li>\n</ul>\n<ul>\n<li>Strong understanding of modern cyber threats, common attack techniques, and adversary TTPs.</li>\n</ul>\n<ul>\n<li>Familiarity with digital forensics tools and malware analysis techniques.</li>\n</ul>\n<ul>\n<li>Experience with cloud-native environments (e.g., AWS, GCP, Azure) and the security telemetry those environments generate.</li>\n</ul>\n<ul>\n<li>Exposure to threat intelligence platforms and integrating intel into detection and investigation workflows.</li>\n</ul>\n<ul>\n<li>Strong communication skills, with the ability to translate complex security findings into clear business impact.</li>\n</ul>\n<ul>\n<li>Relevant security certifications (e.g., GCIH, GCFA, GCIA, CISSP, GDSA) are a plus.</li>\n</ul>\n<p>Compensation packages at Scale for eligible roles include base salary, equity, and benefits. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries for the position, determined by work location and additional factors, including job-related skills, experience, interview performance, and relevant education or training. Scale employees in eligible roles are also granted equity based compensation, subject to Board of Director approval. Your recruiter can share more about the specific salary range for your preferred location during the hiring process, and confirm whether the hired role will be eligible for equity grant. You’ll also receive benefits including, but not limited to: Comprehensive health, dental and vision coverage, retirement benefits, a learning and development stipend, and generous PTO. Additionally, this role may be eligible for additional benefits such as a commuter stipend.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_740da2af-174","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Scale","sameAs":"https://scale.com/","logo":"https://logos.yubhub.co/scale.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/scaleai/jobs/4684073005","x-work-arrangement":"hybrid","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":"$237,600-$297,000 USD","x-skills-required":["Detection Engineering","Incident Response","Security Operations","Cloud Services","Enterprise SaaS","Automation","Telemetry Pipelines","Digital Forensics","Malware Analysis","Threat Intelligence Platforms","SIEM","EDR","SOAR","Cloud-Native Environments","Programming Languages","Python","Go"],"x-skills-preferred":["Hands-on experience designing or improving detection pipelines, SIEM content, and alerting workflows in cloud-native environments","Practical experience with SIEM, EDR, and SOAR tools, with a preference for candidates who have built integrations or extended these platforms programmatically","Strong understanding of modern cyber threats, common attack techniques, and adversary TTPs","Familiarity with digital forensics tools and malware analysis techniques","Experience with cloud-native environments (e.g., AWS, GCP, Azure) and the security telemetry those environments generate","Exposure to threat intelligence platforms and integrating intel into detection and investigation workflows","Strong communication skills, with the ability to translate complex security findings into clear business impact","Relevant security certifications (e.g., GCIH, GCFA, GCIA, CISSP, GDSA)"],"datePosted":"2026-04-18T16:00:14.303Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"New York, NY; San Francisco, CA; Seattle, WA; Washington, DC"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Detection Engineering, Incident Response, Security Operations, Cloud Services, Enterprise SaaS, Automation, Telemetry Pipelines, Digital Forensics, Malware Analysis, Threat Intelligence Platforms, SIEM, EDR, SOAR, Cloud-Native Environments, Programming Languages, Python, Go, Hands-on experience designing or improving detection pipelines, SIEM content, and alerting workflows in cloud-native environments, Practical experience with SIEM, EDR, and SOAR tools, with a preference for candidates who have built integrations or extended these platforms programmatically, Strong understanding of modern cyber threats, common attack techniques, and adversary TTPs, Familiarity with digital forensics tools and malware analysis techniques, Experience with cloud-native environments (e.g., AWS, GCP, Azure) and the security telemetry those environments generate, Exposure to threat intelligence platforms and integrating intel into detection and investigation workflows, Strong communication skills, with the ability to translate complex security findings into clear business impact, Relevant security certifications (e.g., GCIH, GCFA, GCIA, CISSP, GDSA)","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":237600,"maxValue":297000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_ac012549-95e"},"title":"Fraud Operations Manager","description":"<p>We are hiring a Fraud Operations Manager to lead our Fraud Operations Centre in Bangalore. As a people leader, you will manage team leads and senior associates, setting clear expectations, coaching performance, and building a high-judgement culture rooted in strong decisioning and customer empathy.</p>\n<p>Responsibilities:</p>\n<ul>\n<li>Lead the Bangalore Fraud Operations Centre, managing team leads and senior associates</li>\n<li>Own core fraud investigations and complex investigations, including escalations and time-sensitive incident response in partnership with global Fraud/Risk stakeholders</li>\n<li>Establish and run the operating system for the org: goal setting, team cadences, SOPs, change management, queue health, SLAs, QA programs, calibration, and readiness for new products/markets</li>\n<li>Define, develop, and represent key operational and risk metrics for the Bangalore centre (through dashboards and recurring readouts), translating data into actions and priorities</li>\n<li>Drive process development and continuous improvement: root cause analysis, defect reduction, policy adherence, and consistency across reviewers and teams</li>\n<li>Partner with other Risk teams to evolve fraud tooling and workflows (manual and automated actioning), including safe rollout and measurement of changes</li>\n<li>Support outsourcing relevant workflows: identify transition candidates, design/standardize processes for hand off, and support training as needed</li>\n<li>Own staffing models, capacity planning, scheduling, hiring plans, onboarding, and training strategy to meet business needs while maintaining a high bar for quality and user experience</li>\n<li>Maintain close “floor” engagement: regularly dive into cases, review decisions, support frontline judgment, and ensure feedback loops translate into measurable improvements</li>\n<li>Partner with recruiting to define role profiles and interview loops, drive bar-raising hiring decisions, and build a diverse team</li>\n<li>Own career development and succession planning, team health and engagement</li>\n<li>Build a great culture, a destination workplace, fostering our values, serving as a beacon of Stripe’s user-centric philosophy and culture of transparency, empathy, inclusion, and empowerment</li>\n</ul>\n<p>You are an operations leader who can scale fraud investigation and review programs while staying close to the details. You are fluent in running high-performing teams through clear metrics and operating cadence, and you can partner cross-functionally to evolve tooling and processes. You bring sound judgment, calm execution under pressure, and a bias toward data-backed solutions and measurable improvements in both fraud outcomes and user experience.</p>\n<p>Minimum requirements:</p>\n<ul>\n<li>Experience leading cross-functional initiatives and driving change through ambiguity, including new workflows for new products, markets, or emerging fraud patterns</li>\n<li>Experience leading fraud, risk, trust &amp; safety, or investigations operations in a high-scale environment, including managing managers/team leads</li>\n<li>Ability to partner effectively with internal globally distributed stakeholders and comfortable leading internal teams and vendors</li>\n<li>Proven ability to define and operationalize metrics (e.g., accuracy/quality, SLAs, throughput, loss outcomes, appeals/rework, user friction) and use data to drive priorities</li>\n<li>Comfort working across detection systems and manual/automated actioning systems; ability to translate operational needs into product/engineering requirements</li>\n<li>Strong operational background including new process launches, service delivery and strong at building operating models</li>\n<li>Excellent written and verbal communication skills, including presenting in operational reviews and representing the team in high-pressure escalations in English</li>\n<li>Skill and credibility doing the core work of a user-facing team with a high bar for quality, and a willingness to lead by example</li>\n<li>At least 7+ years of direct people management experience; this includes handling performance management and proactively coach/mentor individuals</li>\n<li>Experience with payments, risk, compliance, or financial industry operations</li>\n</ul>\n<p>Preferred qualifications:</p>\n<ul>\n<li>Demonstrated ability to run an operations centre: capacity planning, scheduling, queue management, performance management, and quality programs</li>\n<li>Strong fraud domain depth across investigation workflows, risk vectors, and decision frameworks; able to independently review cases and guide frontline judgment</li>\n<li>Experience scaling or transforming fraud review operations through process redesign, tooling improvements, and/or vendor partnerships</li>\n<li>Experience with payments risk (CNP/card testing, ATO, merchant fraud, transaction fraud) and familiarity with how upstream detection and downstream enforcement interact</li>\n<li>Strong analytics proficiency (building/owning dashboards; querying data directly) and comfort partnering deeply with data science/engineering</li>\n<li>Experience operating in a global, follow-the-sun model and partnering across time zones</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_ac012549-95e","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Stripe","sameAs":"https://stripe.com/","logo":"https://logos.yubhub.co/stripe.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/stripe/jobs/7608396","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["fraud investigation","risk management","operations leadership","team management","process development","continuous improvement","data analysis","fraud tooling","workflow management","capacity planning","scheduling","queue management","performance management","quality programs","operating models","payments risk","compliance","financial industry operations"],"x-skills-preferred":["fraud domain depth","investigation workflows","risk vectors","decision frameworks","process redesign","tooling improvements","vendor partnerships","CNP/card testing","ATO","merchant fraud","transaction fraud","analytics proficiency","data science","engineering"],"datePosted":"2026-03-31T18:15:48.331Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Bengaluru"}},"employmentType":"FULL_TIME","occupationalCategory":"Finance","industry":"Technology","skills":"fraud investigation, risk management, operations leadership, team management, process development, continuous improvement, data analysis, fraud tooling, workflow management, capacity planning, scheduling, queue management, performance management, quality programs, operating models, payments risk, compliance, financial industry operations, fraud domain depth, investigation workflows, risk vectors, decision frameworks, process redesign, tooling improvements, vendor partnerships, CNP/card testing, ATO, merchant fraud, transaction fraud, analytics proficiency, data science, engineering"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_f940647d-c39"},"title":"SOC Engineer","description":"<p>We are looking for a SOC Engineer to join our Security Operations team and help defend a fast-moving, cloud-native AI vibe-coding platform. In this role, you will stay on top of emerging threats—from 0-days and active exploitation campaigns to bug bounty findings and customer-reported issues—and rapidly determine their relevance and potential impact to Replit.</p>\n<p>This is a hands-on, investigative role requiring strong technical depth, understanding of modern software engineering and CI/CD systems, familiarity with cloud-native infrastructure (especially GCP), and the ability to work across multiple teams in a fast-paced environment.</p>\n<p><strong>Responsibilities</strong></p>\n<p><strong>Threat Awareness &amp; Rapid Assessment</strong></p>\n<ul>\n<li>Continuously monitor emerging threats, including bad actor activity, 0-day vulnerabilities, public exploitation campaigns, bug bounty reports, and customer-reported security issues</li>\n</ul>\n<ul>\n<li>Quickly assess the applicability of these threats to Replit’s cloud infrastructure, SaaS services, internal tooling, and platform components.</li>\n</ul>\n<p><strong>Investigation &amp; Impact Analysis</strong></p>\n<ul>\n<li>Conduct targeted investigations to determine whether Replit is already impacted by a newly discovered threat, vulnerability, or exploit.</li>\n</ul>\n<ul>\n<li>Analyze logs, telemetry, and system behaviors using SIEM, metrics, Cloud Logging, and related tools.</li>\n</ul>\n<ul>\n<li>Identify gaps or weaknesses in existing detection or visibility and propose improvements.</li>\n</ul>\n<p><strong>Containment, Mitigation &amp; Cross-Team Collaboration</strong></p>\n<ul>\n<li>Research potential impact paths and develop mitigation strategies for confirmed or applicable threats.</li>\n</ul>\n<ul>\n<li>Partner closely with Security, SRE, and Engineering teams to coordinate and implement containment, patches, configuration updates, or code-level fixes.</li>\n</ul>\n<ul>\n<li>Document findings, mitigations, and follow-up actions clearly for internal teams.</li>\n</ul>\n<p><strong>Required Skills &amp; Experience</strong></p>\n<ul>\n<li>Strong understanding of software engineering fundamentals, including code structure, build systems, dependencies, and package ecosystems—enabling effective partnership with Engineering teams.</li>\n</ul>\n<ul>\n<li>Understanding of CI/CD pipelines and DevOps workflows, enabling collaboration with Infrastructure and DevOps teams.</li>\n</ul>\n<ul>\n<li>Solid knowledge of cloud architecture, especially Google Cloud Platform (GCP) services used in modern cloud-native deployments.</li>\n</ul>\n<ul>\n<li>Familiarity with SaaS architectures, identity systems, and integration patterns for effective collaboration with Cloud Security teams.</li>\n</ul>\n<ul>\n<li>Hands-on experience with SIEM, Cloud Logging, and log-based investigation workflows.</li>\n</ul>\n<ul>\n<li>Ability to perform investigations using log data, behavioral indicators, and threat intelligence.</li>\n</ul>\n<ul>\n<li>General understanding of vulnerability lifecycles, exploitability analysis, and common attack vectors.</li>\n</ul>\n<p><strong>Preferred Qualifications</strong></p>\n<ul>\n<li>Experience with threat intelligence, security research, or vulnerability analysis.</li>\n</ul>\n<ul>\n<li>Familiarity with Kubernetes, containers, serverless infrastructure, or modern distributed systems.</li>\n</ul>\n<ul>\n<li>Ability to write scripts or small tools for investigation or automation (Python, Go, Bash).</li>\n</ul>\n<ul>\n<li>Experience working with bug bounty programs or coordinated vulnerability disclosure workflows.</li>\n</ul>\n<ul>\n<li>Experience in fast-paced, cloud-native, or AI/ML-driven environments.</li>\n</ul>\n<p><strong>What We Value</strong></p>\n<ul>\n<li>Curiosity &amp; initiative: Strong desire to understand attacker behaviors, emerging threats, and how they apply to real-world systems.</li>\n</ul>\n<ul>\n<li>Speed &amp; analytical rigor: Ability to quickly assess high-risk vulnerabilities with clear, evidence-based reasoning.</li>\n</ul>\n<ul>\n<li>Collaboration: Comfort working across cross-functional teams spanning Security, SRE, Engineering, and Infrastructure.</li>\n</ul>\n<ul>\n<li>Clear communication: Ability to explain findings, risks, and mitigation strategies to stakeholders at all levels.</li>\n</ul>\n<ul>\n<li>Ownership mindset: Takes initiative to drive investigations, improvements, and remediations to completion</li>\n</ul>\n<ul>\n<li>Continuous learning: Passion for staying up to date on new vulnerabilities, exploit trends, and cloud-native security best practices.</li>\n</ul>\n<p><strong>Full-Time Employee Benefits Include:</strong></p>\n<p>💰 Competitive Salary &amp; Equity</p>\n<p>💹 401(k) Program with a 4% match</p>\n<p>⚕️ Health, Dental, Vision and Life Insurance</p>\n<p>🩼 Short Term and Long Term Disability</p>\n<p>🚼 Paid Parental, Medical, Caregiver Leave</p>\n<p>🚗 Commuter Benefits</p>\n<p>📱 Monthly Wellness Stipend</p>\n<p>🧑‍💻 Autonomous Work Environment</p>\n<p>🖥 In Office Set-Up Reimbursement</p>\n<p>🏝 Flexible Time Off (FTO) + Holidays</p>\n<p>🚀 Quarterly Team Gatherings</p>\n<p>☕ In Office Amenities</p>\n<p><strong>Want to learn more about what we are up to?</strong></p>\n<ul>\n<li>Meet the Replit Agent</li>\n</ul>\n<ul>\n<li>Replit: Make an app for that</li>\n</ul>\n<ul>\n<li>Replit Blog</li>\n</ul>\n<ul>\n<li>Amjad TED Talk</li>\n</ul>\n<p><strong>Interviewing + Culture at Replit</strong></p>\n<ul>\n<li>Operating Principles</li>\n</ul>\n<ul>\n<li>Reasons not to work at Replit</li>\n</ul>\n<p>To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_f940647d-c39","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Replit","sameAs":"https://jobs.ashbyhq.com","logo":"https://logos.yubhub.co/replit.com.png"},"x-apply-url":"https://jobs.ashbyhq.com/replit/54051fe0-045f-46b1-a2b8-a730575b05eb","x-work-arrangement":"hybrid","x-experience-level":"mid","x-job-type":"full-time","x-salary-range":"$180K – $250K","x-skills-required":["software engineering fundamentals","CI/CD systems","cloud-native infrastructure","GCP services","SaaS architectures","identity systems","integration patterns","SIEM","Cloud Logging","log-based investigation workflows","vulnerability lifecycles","exploitability analysis","common attack vectors"],"x-skills-preferred":["threat intelligence","security research","vulnerability analysis","Kubernetes","containers","serverless infrastructure","modern distributed systems","Python","Go","Bash","bug bounty programs","coordinated vulnerability disclosure workflows","fast-paced","cloud-native","AI/ML-driven environments"],"datePosted":"2026-03-07T15:20:18.290Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Foster City, CA"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"software engineering fundamentals, CI/CD systems, cloud-native infrastructure, GCP services, SaaS architectures, identity systems, integration patterns, SIEM, Cloud Logging, log-based investigation workflows, vulnerability lifecycles, exploitability analysis, common attack vectors, threat intelligence, security research, vulnerability analysis, Kubernetes, containers, serverless infrastructure, modern distributed systems, Python, Go, Bash, bug bounty programs, coordinated vulnerability disclosure workflows, fast-paced, cloud-native, AI/ML-driven environments","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":180000,"maxValue":250000,"unitText":"YEAR"}}}]}