{"version":"0.1","company":{"name":"YubHub","url":"https://yubhub.co","jobsUrl":"https://yubhub.co/jobs/skill/siem-platforms"},"x-facet":{"type":"skill","slug":"siem-platforms","display":"Siem Platforms","count":7},"x-feed-size-limit":100,"x-feed-sort":"enriched_at desc","x-feed-notice":"This feed contains at most 100 jobs (the most recently enriched). For the full corpus, use the paginated /stats/by-facet endpoint or /search.","x-generator":"yubhub-xml-generator","x-rights":"Free to redistribute with attribution: \"Data by YubHub (https://yubhub.co)\"","x-schema":"Each entry in `jobs` follows https://schema.org/JobPosting. YubHub-native raw fields carry `x-` prefix.","jobs":[{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_c2aaf7ac-804"},"title":"Security Engineer - Threat Detection","description":"<p><strong>Job Description</strong></p>\n<p>You will design, build, and maintain detections that identify malicious activity across Stripe&#39;s infrastructure, applications, and cloud environments.</p>\n<p><strong>Responsibilities</strong></p>\n<ul>\n<li>Design, build, and tune high-fidelity detections across modern SIEM platforms, covering adversary TTPs across the full attack lifecycle</li>\n<li>Develop detection hypotheses by researching TTPs, identifying evidence sources, and determining detection opportunities across available telemetry</li>\n<li>Conduct hypothesis-driven threat hunts to identify malicious activity, uncover detection gaps, and validate security controls</li>\n<li>Perform malware analysis and reverse engineering to extract indicators and inform detection strategies</li>\n<li>Build network-based detections (flow, pcap, protocol analysis) and endpoint-based detections (event logs, EDR telemetry, memory/file artifacts) across Windows, Linux, and macOS</li>\n<li>Partner with Threat Intelligence to operationalize intel reports into detections, hunting leads, and enrichment logic</li>\n<li>Collaborate with IR, SOC, and offensive security teams to validate and refine detections based on real-world incidents and red team exercises</li>\n<li>Build data pipelines, automation, and tooling that enable detection-as-code practices and scalable deployment</li>\n<li>Map detection coverage to MITRE ATT&amp;CK, identifying and prioritizing gaps across key attack surfaces</li>\n<li>Lead projects, mentor teammates, and champion quality standards within the team</li>\n</ul>\n<p><strong>Requirements</strong></p>\n<ul>\n<li>5+ years of experience in detection engineering, threat hunting, or security operations</li>\n<li>Demonstrated experience writing detection logic in modern SIEM platforms (e.g., Splunk, Chronicle, Elastic, CrowdStrike NG-SIEM, Panther, Microsoft Sentinel)</li>\n<li>Strong understanding of adversary tradecraft across the attack lifecycle: initial access, privilege escalation, lateral movement, defense evasion, persistence, and exfiltration</li>\n<li>Ability to extract TTPs from threat intelligence reports and translate them into detection opportunities</li>\n<li>Experience developing network-based and endpoint-based detections across multiple OS platforms (Windows, Linux, macOS)</li>\n<li>Experience analyzing telemetry across endpoint, network, cloud (AWS/GCP/Azure), identity, and application log sources</li>\n<li>Proficiency in detection/query languages (SPL, KQL, EQL, YARA-L, SQL) and programming (Python or similar)</li>\n<li>Strong communication skills with the ability to document detection logic and explain findings to technical and non-technical audiences</li>\n<li>Adversarial mindset , understanding how attackers operate to build detections that catch real-world threats</li>\n</ul>\n<p><strong>Preferred Qualifications</strong></p>\n<ul>\n<li>Experience in detection engineering or threat hunting within fintech, financial services, or highly regulated environments</li>\n<li>Background in malware analysis, reverse engineering, or threat research</li>\n<li>Experience with purple team operations , collaborating with offensive security to validate detections</li>\n<li>Familiarity with big data platforms (Databricks, Trino, PySpark) for large-scale log analysis</li>\n<li>Proficiency with AI/LLM-assisted development tools (Claude Code, Cursor, GitHub Copilot) applied to detection workflows</li>\n<li>Interest in agentic automation , using LLMs to augment hunting, tuning, or triage</li>\n<li>Experience with detection validation tools (Atomic Red Team, ATT&amp;CK Evaluations)</li>\n<li>Contributions to open-source detection content, research, or conference presentations</li>\n<li>Relevant certifications such as HTB CDSA, GCIH, GCFA, GNFA, OSCP, TCM PMAT, or GREM</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_c2aaf7ac-804","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Stripe","sameAs":"https://stripe.com/","logo":"https://logos.yubhub.co/stripe.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/stripe/jobs/7827230","x-work-arrangement":"remote","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["detection engineering","threat hunting","security operations","SIEM platforms","adversary tradecraft","network-based detections","endpoint-based detections","telemetry analysis","detection/query languages","programming","communication skills"],"x-skills-preferred":["fintech","financial services","malware analysis","reverse engineering","purple team operations","big data platforms","AI/LLM-assisted development tools","agentic automation","detection validation tools","open-source detection content","relevant certifications"],"datePosted":"2026-04-18T15:53:27.161Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Ireland"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"detection engineering, threat hunting, security operations, SIEM platforms, adversary tradecraft, network-based detections, endpoint-based detections, telemetry analysis, detection/query languages, programming, communication skills, fintech, financial services, malware analysis, reverse engineering, purple team operations, big data platforms, AI/LLM-assisted development tools, agentic automation, detection validation tools, open-source detection content, relevant certifications"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_bdf949b3-c66"},"title":"Databricks Enterprise Lead Security Architect -   Principal IT Software Engineer","description":"<p>We are seeking a highly skilled Lead Security Architect to join our team within Databricks IT. As a Lead Security Architect, you will be responsible for designing and implementing a secure and scalable architecture to protect our corporate assets. You will focus on key areas of IT security, including Identity and Access Management, Zero Trust architecture, and endpoint security, while also working to secure critical business applications and sensitive data.</p>\n<p>Your expertise will be crucial in building proactive security strategies that align with our business goals and protect the company from an ever-evolving threat landscape. This position demands deep expertise in security principles and a comprehensive understanding of the entire infrastructure stack and IAM systems to design robust, future-ready security solutions.</p>\n<p>You will be instrumental in safeguarding our systems&#39; resilience and integrity against ever-evolving cyber threats. You will play a critical role in shaping our security strategy for modern platforms across AWS, Azure, GCP, network infrastructure, storage, and SaaS solutions, help establish a strong least privilege (PoLP) model, providing specialized IAM expertise, and securely supporting SaaS with sensitive information (NHI).</p>\n<p>You will also be a key contributor in building our internal strategy for secure AI development. Additionally, you will support the secure integration of SaaS platforms such as Google Workspace, collaboration tools, and GTM systems, maintaining alignment with enterprise security standards.</p>\n<p>Close collaboration with cross-functional teams is essential to embed security throughout the technology stack.</p>\n<p>The impact you will have:</p>\n<ul>\n<li>Design and implement secure, scalable reference architectures for the Databricks IT across Cloud Infra (Compute, DBs, Network, Storage), SaaS, Custom Built Applications, Data &amp; AI systems.</li>\n<li>Establish and enforce security controls for: Core Security Areas: - Databricks Workspace Management: Workspace isolation, Unity Catalog for data governance.</li>\n<li>Secure Networking: VPC configs, PrivateLink, IP Allow Lists.</li>\n<li>Identity and Access Management (IAM): SSO, SCIM user provisioning, RBAC via Un, Strong MFA best practices for enterprise identities and customers.</li>\n<li>Data Encryption: At rest and in transit, customer-managed keys for critical assets.</li>\n<li>Data Exfiltration Prevention: Admin console settings, VPC endpoint controls.</li>\n<li>Cluster Security: User isolation, compliance with enhanced security monitoring/Compliance Security Profiles (HIPAA, PCI-DSS, FedRAMP).</li>\n<li>Offensive Security: Test and challenge the effectiveness of the organization’s security defenses by mimicking the tactics, techniques, and procedures used by actual attackers.</li>\n<li>Specialized Security Functions: - Non-human Identity Management: Design and implement secure authentication and authorization for automated systems (service accounts, API keys, machine identities), focusing on automation and integration with existing identity management systems.</li>\n<li>IAM Best Practices: Develop and document comprehensive Identity and Access Management policies, including user provisioning, de-provisioning, access reviews, privileged access management, and multi-factor authentication, ensuring security and compliance.</li>\n<li>Data Loss Prevention (DLP): Implement DLP solutions to identify, monitor, and protect sensitive data across endpoints, networks, and cloud environments, preventing unauthorized access, use, or transmission.</li>\n<li>SaaS Proxy Design and Implementation: Design and implement cloud-based proxies for SaaS applications (SASE solutions) to provide secure access, enforce security policies, monitor user activity, and protect against threats.</li>\n<li>Cloud Infrastructure Best Practices: Establish and document best practices for VPC configurations, cloud networking, and infrastructure as code using Terraform, ensuring secure network segmentation, routing, firewalls, and VPNs for consistent, automated, and secure deployments.</li>\n<li>Least Privilege Access for Data Security: Design and implement data security controls based on the principle of least privilege, ensuring users and systems have only the minimum necessary access through fine-grained controls, data classification, and regular access reviews.</li>\n<li>Guide internal IT on Databricks’ security and compliance certifications (SOC 2, ISO 27001/27017/27018, HIPAA, PCI-DSS, FedRAMP), and support security reviews/audits.</li>\n<li>Support incident response, vulnerability management, threat modeling, and red teaming using audit logs, cluster policies, and enhanced monitoring.</li>\n<li>Stay current on industry trends and emerging threats in GenAI, AI Agentic flow, MCPs to enhance security posture.</li>\n<li>Advise executive leadership on security architecture, risks, and mitigation.</li>\n<li>Mentor security engineers and developers on secure design and best practices.</li>\n</ul>\n<p>What we look for:</p>\n<ul>\n<li>Bachelor’s degree in Computer Science, Information Security, Engineering, or a related field</li>\n<li>Master’s degree in Computer Science specifically in Information Security or a related discipline is strongly preferred</li>\n<li>Minimum 12 years in cybersecurity, with 5+ in security architecture or senior technical roles.</li>\n<li>Experience in FedRAMP High systems/ GovCloud preferred.</li>\n<li>Must have direct experience designing and securing enterprise platforms in complex multi-cloud environments, deep knowledge of enterprise architecture and security features (control plane/data plane separation, network infra, workspace hardening, network segmentation/ isolation), and hands-on experience automating security controls with Terraform and scripting.</li>\n<li>Proven expertise securing data analytics pipelines, SaaS integrations, and workload isolation in enterprise ecosystems.</li>\n<li>Experience with Enterprise Security Analysis Tools and monitoring/security policy optimization.</li>\n<li>Deep experience in threat modeling, design, PoC, and implementing large-scale enterprise solutions.</li>\n<li>Extensive hands-on experience in AWS cloud security, network security, with knowledge of Zero Trust, Data Protection, and Appsec.</li>\n<li>Strong understanding of enterprise IAM systems (Okta, SailPoint, VDI, Entra ID) and Data Protection.</li>\n<li>Expert experience with SIEM platforms, XDR, and cloud-native threat detection tools.</li>\n<li>Expert in web application security, OWASP, API security, and secure design and testing.</li>\n<li>Hands-on experience with security automation is required, with proficiency in AI-assisted development, Python, Cursor, Lambda, Terraform, or comparable scripting/IaC tools for operational efficiency.</li>\n<li>Industry certifications like CISSP, CCSP, CEH, AWS Certified Security – Specialty, AWS Certified Solutions Architect – Professional, or AWS Certified Advanced Networking – Specialty (or equivalent) are preferred.</li>\n<li>Ability to influence stakeholders and drive alignment.</li>\n<li>Strategic thinker with a passion for security innovation, continuous improvement, and building scalable defenses.</li>\n</ul>\n<p>Pay Range Transparency</p>\n<p>Databricks is committed to fair and equitable compensation practices. The pay range(s) for this role is listed below and represents the expected salary range for non-commissionable roles or on-target earnings for commissionable roles. Actual compensation packages are based on several factors that are unique to each candidate, including but not limited to job-related skills, depth of experience, relevant certifications and training, and specific work location. Based on the factors above, Databricks anticipates utilizing the full width of the range. The total compensation package for this position may also include eligibility for annual performance bonus, equity, and the benefits listed above.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_bdf949b3-c66","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Databricks","sameAs":"https://databricks.com","logo":"https://logos.yubhub.co/databricks.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/databricks/jobs/8207910002","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Security Architecture","Identity and Access Management","Zero Trust","Endpoint Security","Data Encryption","Data Exfiltration Prevention","Cluster Security","Offensive Security","Non-human Identity Management","IAM Best Practices","Data Loss Prevention","SaaS Proxy Design and Implementation","Cloud Infrastructure Best Practices","Least Privilege Access for Data Security","Guide internal IT on Databricks’ security and compliance certifications","Support incident response, vulnerability management, threat modeling, and red teaming","Stay current on industry trends and emerging threats in GenAI, AI Agentic flow, MCPs","Advise executive leadership on security architecture, risks, and mitigation","Mentor security engineers and developers on secure design and best practices"],"x-skills-preferred":["Terraform","Python","Cursor","Lambda","AWS cloud security","Network security","Data Protection","Appsec","SIEM platforms","XDR","cloud-native threat detection tools","Web application security","OWASP","API security","Secure design and testing","AI-assisted development","Security automation","Scripting/IaC tools","CISSP","CCSP","CEH","AWS Certified Security – Specialty","AWS Certified Solutions Architect – Professional","AWS Certified Advanced Networking – Specialty"],"datePosted":"2026-04-18T15:45:19.828Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Mountain View, California; San Francisco, California"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Security Architecture, Identity and Access Management, Zero Trust, Endpoint Security, Data Encryption, Data Exfiltration Prevention, Cluster Security, Offensive Security, Non-human Identity Management, IAM Best Practices, Data Loss Prevention, SaaS Proxy Design and Implementation, Cloud Infrastructure Best Practices, Least Privilege Access for Data Security, Guide internal IT on Databricks’ security and compliance certifications, Support incident response, vulnerability management, threat modeling, and red teaming, Stay current on industry trends and emerging threats in GenAI, AI Agentic flow, MCPs, Advise executive leadership on security architecture, risks, and mitigation, Mentor security engineers and developers on secure design and best practices, Terraform, Python, Cursor, Lambda, AWS cloud security, Network security, Data Protection, Appsec, SIEM platforms, XDR, cloud-native threat detection tools, Web application security, OWASP, API security, Secure design and testing, AI-assisted development, Security automation, Scripting/IaC tools, CISSP, CCSP, CEH, AWS Certified Security – Specialty, AWS Certified Solutions Architect – Professional, AWS Certified Advanced Networking – Specialty"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_9bf55fe3-b2b"},"title":"Detection & Response Engineer","description":"<p>We are seeking a skilled and proactive Detection &amp; Response Engineer to join our security team. In this critical role, you will be responsible for detecting, investigating, and responding to security incidents across our cloud-native and AI-focused infrastructure.</p>\n<p><strong>Responsibilities</strong></p>\n<ul>\n<li>Monitor and analyse security alerts and logs to identify potential threats and anomalies</li>\n<li>Develop, implement, and maintain detection rules and correlation logic in our SIEM platform</li>\n<li>Conduct thorough investigations of security incidents, performing root cause analysis and impact assessments</li>\n<li>Lead incident response efforts, coordinating with relevant teams to contain and mitigate threats</li>\n<li>Create and maintain incident response playbooks and runbooks</li>\n<li>Perform regular threat hunting activities to proactively identify potential security risks</li>\n<li>Develop and refine metrics and reporting to track the effectiveness of detection and response capabilities</li>\n<li>Collaborate with other security teams to improve overall security posture and incident handling processes</li>\n<li>Stay current with emerging threats, attack techniques, and defensive strategies in the cloud-native and AI domains</li>\n</ul>\n<p><strong>Basic Qualifications</strong></p>\n<ul>\n<li>Bachelor&#39;s degree in Computer Science, Cybersecurity, or a related field</li>\n<li>3-5 years of experience in security operations, incident response, or a similar role</li>\n<li>Strong understanding of cybersecurity principles, attack techniques, and defensive strategies</li>\n<li>Proficiency in at least one scripting language (e.g., Python, Rust) for automation and tool development</li>\n<li>Experience with SIEM platforms and log analysis tools</li>\n<li>Familiarity with cloud environments (e.g., AWS, GCP, Azure) and their security features</li>\n<li>Knowledge of network protocols, system administration, and common attack vectors</li>\n<li>Strong analytical and problem-solving skills with attention to detail</li>\n<li>Excellent communication skills and ability to work effectively under pressure</li>\n</ul>\n<p><strong>Preferred Skills and Experience</strong></p>\n<ul>\n<li>Relevant security certifications (e.g., GCIH, GCIA, SANS)</li>\n<li>Experience with threat intelligence platforms and their integration into detection processes</li>\n<li>Familiarity with AI/ML security implications, particularly those outlined in the OWASP LLM Top 10</li>\n<li>Knowledge of software supply chain security and SBOM analysis</li>\n<li>Experience with containerized environments and Kubernetes security</li>\n<li>Experience in building custom security tools or integrations to enhance detection and response capabilities</li>\n<li>Interest in leveraging AI to improve threat detection and automate response processes</li>\n<li>Contributions to open-source security projects or threat research</li>\n<li>Experience with digital forensics and malware analysis</li>\n</ul>\n<p><strong>Compensation and Benefits</strong></p>\n<p>$200,000 - $340,000 USD</p>\n<p>Base salary is just one part of our total rewards package at xAI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short &amp; long-term disability insurance, life insurance, and various other discounts and perks.</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_9bf55fe3-b2b","directApply":true,"hiringOrganization":{"@type":"Organization","name":"xAI","sameAs":"https://www.xai.com/","logo":"https://logos.yubhub.co/xai.com.png"},"x-apply-url":"https://job-boards.greenhouse.io/xai/jobs/4559148007","x-work-arrangement":"onsite","x-experience-level":"mid","x-job-type":"full-time","x-salary-range":"$200,000 - $340,000 USD","x-skills-required":["cybersecurity principles","attack techniques","defensive strategies","scripting language","SIEM platforms","log analysis tools","cloud environments","network protocols","system administration","common attack vectors"],"x-skills-preferred":["relevant security certifications","threat intelligence platforms","AI/ML security implications","software supply chain security","containerized environments","Kubernetes security","custom security tools","digital forensics","malware analysis"],"datePosted":"2026-04-18T15:23:47.430Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Palo Alto, CA"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"cybersecurity principles, attack techniques, defensive strategies, scripting language, SIEM platforms, log analysis tools, cloud environments, network protocols, system administration, common attack vectors, relevant security certifications, threat intelligence platforms, AI/ML security implications, software supply chain security, containerized environments, Kubernetes security, custom security tools, digital forensics, malware analysis","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","minValue":200000,"maxValue":340000,"unitText":"YEAR"}}},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_8ae5b8d5-5a4"},"title":"Security Engineer","description":"<p>As a Security Engineer at Yuno, you will be responsible for embedding security by default across our development and operations workflows.</p>\n<p>In this role, you will work closely with Engineering and DevOps teams to design, implement, and maintain secure cloud infrastructure, CI/CD pipelines, and containerized environments.</p>\n<p>You will play a key role in strengthening our security posture across AWS and GCP, automating security controls through infrastructure as code, and ensuring compliance with industry standards such as PCI DSS and SOC 2, enabling Yuno to scale securely in the global payments ecosystem.</p>\n<p>Responsibilities:</p>\n<ul>\n<li><p>Design, build, and maintain secure and scalable internal security solutions and tools using Python to support security operations and strengthen technical controls.</p>\n</li>\n<li><p>Improve and manage security configurations in AWS and GCP (including WAF, Security Hub, IAM policies, SIEM integrations and other critical services) to continuously strengthen our overall cloud security posture and ensure best practices are implemented.</p>\n</li>\n<li><p>Implement and maintain security processes and technical controls that support compliance requirements (e.g., PCI DSS, ISO 27001/27701, SOC 2).</p>\n</li>\n<li><p>Collaborate with different teams on cross-functional security initiatives, providing technical expertise and ensuring alignment with best practices.</p>\n</li>\n<li><p>Explore and evaluate emerging technologies and architectures (e.g., AI integrations) to ensure secure adoption.</p>\n</li>\n</ul>\n<p>Skills You Need:</p>\n<ul>\n<li><p>4+ years of hands-on experience in security engineering or similar technical security roles.</p>\n</li>\n<li><p>Strong experience designing and developing security tools or internal products to support security operations using Python.</p>\n</li>\n<li><p>Solid knowledge of AWS and GCP security services and configurations.</p>\n</li>\n<li><p>Practical experience working with compliance frameworks (e.g., PCI DSS, ISO 27001/27701, SOC 2) in cloud environments.</p>\n</li>\n<li><p>Strong problem-solving skills and the ability to communicate and collaborate effectively with cross-functional teams.</p>\n</li>\n<li><p>Verbal and written English fluency.</p>\n</li>\n</ul>\n<p>Preferred Qualifications:</p>\n<ul>\n<li><p>Familiarity with SIEM platforms and security monitoring tools.</p>\n</li>\n<li><p>Experience with Kubernetes and container security.</p>\n</li>\n<li><p>Experience with infrastructure as code (e.g., Terraform, CloudFormation).</p>\n</li>\n<li><p>Familiarity with emerging architectures (e.g., serverless, event-driven, AI integrations).</p>\n</li>\n<li><p>Experience embedding security practices across the software development lifecycle, including CI/CD pipelines.</p>\n</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_8ae5b8d5-5a4","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Yuno","sameAs":"https://www.yuno.com/","logo":"https://logos.yubhub.co/yuno.com.png"},"x-apply-url":"https://jobs.lever.co/yuno/f67be624-8969-4967-baec-1d924213a482","x-work-arrangement":"remote","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Python","AWS","GCP","PCI DSS","SOC 2","ISO 27001/27701","Cloud security","Infrastructure as code","CI/CD pipelines","Container security"],"x-skills-preferred":["SIEM platforms","Kubernetes","Terraform","CloudFormation","Serverless","Event-driven","AI integrations"],"datePosted":"2026-04-17T13:10:45.504Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"London"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Python, AWS, GCP, PCI DSS, SOC 2, ISO 27001/27701, Cloud security, Infrastructure as code, CI/CD pipelines, Container security, SIEM platforms, Kubernetes, Terraform, CloudFormation, Serverless, Event-driven, AI integrations"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_85f1ada0-78d"},"title":"Security Engineer","description":"<p>We&#39;re seeking a Security Engineer at the senior-level or above on our Security Operations team with strong detection engineering experience. You&#39;ll design and develop high-fidelity detection content, build and operate the data pipelines that power our security operations, develop automation playbooks that accelerate response, and work across a uniquely diverse telemetry landscape spanning cloud infrastructure, embedded vessel platforms, corporate systems, and operational technology.</p>\n<p>This role is heavily weighted toward detection engineering. You should think in terms of adversary behaviour and telemetry coverage, not just alert triage. You&#39;ll own detections end-to-end: from identifying gaps in coverage, through designing and testing detection logic, to tuning and validating in production.</p>\n<p>Key Responsibilities:</p>\n<ul>\n<li><p>Design, build, test, and tune high-fidelity detection rules and analytic queries across endpoint, cloud, network, identity, and DLP telemetry sources</p>\n</li>\n<li><p>Develop and maintain detection content using detection-as-code practices including version-controlled logic, automated testing, and CI/CD deployment</p>\n</li>\n<li><p>Map detection coverage to MITRE ATT&amp;CK, identify gaps, and prioritise new detection development based on threat intelligence and business risk</p>\n</li>\n<li><p>Engineer correlation rules, behavioural analytics, and anomaly-based detections that minimise false positives while surfacing real adversary tradecraft</p>\n</li>\n<li><p>Own the detection lifecycle from initial development through production tuning, performance monitoring, and retirement</p>\n</li>\n<li><p>Build and operate pipelines to ingest, normalise, enrich, and manage security telemetry at scale across diverse data sources, using Terraform and infrastructure-as-code practices to deploy and maintain logging and detection infrastructure</p>\n</li>\n<li><p>Design and maintain log collection, parsing, and enrichment configurations that ensure the right telemetry is available at the right fidelity for detection and investigation</p>\n</li>\n<li><p>Evaluate and onboard new telemetry sources as Saronic&#39;s infrastructure and threat landscape evolve</p>\n</li>\n<li><p>Monitor pipeline health, data quality, and ingestion reliability to ensure detections operate on complete and accurate data</p>\n</li>\n<li><p>Develop and manage automated response playbooks in SOAR platforms to accelerate containment and reduce analyst toil</p>\n</li>\n<li><p>Build automation that enriches alerts with contextual data, reducing investigation time and improving analyst decision-making</p>\n</li>\n<li><p>Support incident response efforts and translate lessons learned into improved detections and playbooks</p>\n</li>\n<li><p>Partner with SOC analysts, Cloud Security, Product Security, and IT teams to close visibility and detection gaps across environments</p>\n</li>\n<li><p>Collaborate with threat intelligence to ensure detection engineering is informed by current adversary TTPs relevant to defence, maritime, and autonomous systems</p>\n</li>\n</ul>\n<p>Required Qualifications:</p>\n<ul>\n<li><p>3+ years of hands-on experience in detection engineering, security operations, security automation, or a closely related security engineering role</p>\n</li>\n<li><p>Demonstrated experience designing, testing, and tuning detection rules and analytic queries across production security telemetry (endpoint, cloud, network, identity, or DLP)</p>\n</li>\n<li><p>Hands-on experience with SIEM platforms and proficiency with query languages such as SPL, KQL, or equivalent</p>\n</li>\n<li><p>Experience building and operating security data pipelines, including log ingestion, normalisation, enrichment, and data quality management</p>\n</li>\n<li><p>Understanding of data engineering concepts including ETL pipelines, data modelling, schema design, and indexing as applied to security telemetry</p>\n</li>\n<li><p>Hands-on coding experience in Python, PowerShell, Go, or Rust for security automation, detection tooling, or pipeline development, and familiarity with Terraform for managing detection and logging infrastructure as code</p>\n</li>\n<li><p>Understanding of MITRE ATT&amp;CK framework and its application to detection coverage and gap analysis</p>\n</li>\n<li><p>Ability to obtain and maintain a security clearance</p>\n</li>\n</ul>\n<p>Preferred Qualifications:</p>\n<ul>\n<li><p>Experience in defence, aerospace, robotics, autonomy, or other high-assurance environments</p>\n</li>\n<li><p>Experience with EDR platforms including custom detection rule creation and telemetry analysis</p>\n</li>\n<li><p>Experience with cloud-native detection in AWS and Microsoft 365/Azure</p>\n</li>\n<li><p>Experience using Terraform to deploy and manage security monitoring infrastructure, log pipeline components, or cloud-native security service configurations</p>\n</li>\n<li><p>Hands-on experience with incident response, threat hunting, or adversary emulation</p>\n</li>\n<li><p>Exposure to embedded Linux, operational technology, or ICS telemetry and detection</p>\n</li>\n<li><p>Familiarity with NIST SP 800-171, NIST SP 800-53, or CMMC and their logging and monitoring requirements</p>\n</li>\n<li><p>Relevant certifications such as GCIH, GCIA, GCDA, GSOM, OSDA, or OSCP</p>\n</li>\n</ul>\n<p>Additional Information:</p>\n<ul>\n<li><p>Benefits: Medical Insurance, Dental and Vision Insurance, Time Off, Parental Leave, Competitive Salary, Retirement Plan, Stock Options, Life and Disability Insurance, Pet Insurance</p>\n</li>\n<li><p>This role requires access to export-controlled information or items that require &#39;U.S. Person&#39; status.</p>\n</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_85f1ada0-78d","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Saronic Technologies","sameAs":"https://www.saronictechnologies.com/","logo":"https://logos.yubhub.co/saronictechnologies.com.png"},"x-apply-url":"https://jobs.lever.co/saronic/79424778-76c1-41c6-8385-cba5f6ddc50e","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["detection engineering","security operations","security automation","SIEM platforms","query languages","data engineering","ETL pipelines","data modelling","schema design","indexing","Python","PowerShell","Go","Rust","Terraform","MITRE ATT&CK framework","security clearance"],"x-skills-preferred":["EDR platforms","cloud-native detection","incident response","threat hunting","adversary emulation","embedded Linux","operational technology","ICS telemetry","NIST SP 800-171","NIST SP 800-53","CMMC","GCIH","GCIA","GCDA","GSOM","OSDA","OSCP"],"datePosted":"2026-04-17T12:56:57.672Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"San Francisco"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"detection engineering, security operations, security automation, SIEM platforms, query languages, data engineering, ETL pipelines, data modelling, schema design, indexing, Python, PowerShell, Go, Rust, Terraform, MITRE ATT&CK framework, security clearance, EDR platforms, cloud-native detection, incident response, threat hunting, adversary emulation, embedded Linux, operational technology, ICS telemetry, NIST SP 800-171, NIST SP 800-53, CMMC, GCIH, GCIA, GCDA, GSOM, OSDA, OSCP"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_55d2bc34-fc1"},"title":"CyberSecurity Engineer, SOC Analyst","description":"<p>About Mistral AI\nAt Mistral AI, we believe in the power of AI to simplify tasks, save time, and enhance learning and creativity. Our technology is designed to integrate seamlessly into daily working life.</p>\n<p>Role Summary\nMistral AI is looking for a Security Operations Center (SOC) Analyst to monitor, defend and respond to threats across our rapidly evolving AI ecosystem. You will treat security telemetry as the core of our active defense. Your objective is to ensure the continuous security of our diverse environment, spanning IT, Engineering, Science, Compute and Infrastructure by building robust detection mechanisms and moving swiftly from alert to automated response.</p>\n<p>Responsibilities\n• Partner with engineering and platform teams to ensure the comprehensive centralization of security logs across all Mistral environments.\n• Design, test, and continuously tune high-fidelity alert scenarios and correlation rules to detect anomalous behavior while minimizing alert fatigue.\n• Operationalize Cyber Threat Intelligence (CTI), monitoring the landscape for threats specific to AI and cloud infrastructure, and integrating actionable intel directly into our detection pipelines.\n• Conduct rigorous, deep-dive investigations into security alerts, tracking root causes, identifying potential lateral movement, and determining impact.\n• Drive the lifecycle of security incidents from containment to remediation, and coordinate cross-functional crisis management during high-severity events.</p>\n<p>About You\n• 3+ years of experience in a Security Operations Center (SOC), Incident Response, or Threat Hunting role, ideally within a cloud-native or fast-paced tech environment.\n• Deep understanding of the threat landscape, the MITRE ATT&amp;CK framework, and the methodologies required to protect high-value infrastructure and intellectual property.\n• Strong experience writing complex queries (e.g., KQL, Splunk SPL, or similar) and leveraging SIEM platforms to build out correlation rules and detection logic.\n• Ability to write practical automation scripts in Python or Go to interact with security APIs, enrich alert context, and streamline response workflows.\n• Proven experience participating in or leading incident response efforts, demonstrating a calm, methodical approach to high-pressure crisis management.</p>\n<p>Hiring Process\n• Introduction call - 30 min\n• Hiring Manager interview - 30 min\n• Technical Rounds - Dee-Dive interview - 55 min - Panel interview - 1h15\n• Culture-fit discussion - 30 min\n• References</p>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_55d2bc34-fc1","directApply":true,"hiringOrganization":{"@type":"Organization","name":"Mistral AI","sameAs":"https://mistral.ai","logo":"https://logos.yubhub.co/mistral.ai.png"},"x-apply-url":"https://jobs.lever.co/mistral/f9782b09-ca3c-4bfc-ba7a-349551ef9a82","x-work-arrangement":"onsite","x-experience-level":"senior","x-job-type":"full-time","x-salary-range":null,"x-skills-required":["Security Operations Center (SOC)","Incident Response","Threat Hunting","KQL","Splunk SPL","SIEM platforms","Python","Go","security APIs","alert context","response workflows"],"x-skills-preferred":[],"datePosted":"2026-04-17T12:46:59.040Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Paris"}},"employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"Security Operations Center (SOC), Incident Response, Threat Hunting, KQL, Splunk SPL, SIEM platforms, Python, Go, security APIs, alert context, response workflows"},{"@context":"https://schema.org","@type":"JobPosting","identifier":{"@type":"PropertyValue","name":"YubHub","value":"job_1d0184f1-be6"},"title":"Security Engineer","description":"<p><strong>About the Role</strong></p>\n<p>We&#39;re hiring our first Security Engineer to own the process of safeguarding our systems, infrastructure, applications, and data. As the first security hire, you will build out our security operations and vulnerability management process for our AI gateway platform. You&#39;ll implement programs, run tooling, ship security fixes, and drive remediation across our stack. You’ll be responsible for all aspects of ensuring the security of our platform and users. This isn&#39;t a compliance paperwork role; it&#39;s a hands-on security position with direct impact on how we protect millions of API requests daily. You&#39;ll work closely with engineering and senior leadership to ship security improvements that actually matter.</p>\n<p><strong>What You&#39;ll Do</strong></p>\n<ul>\n<li>Deploy and operate vulnerability scanning across our cloud infrastructure. Triage findings and drive remediation with engineering teams.</li>\n</ul>\n<ul>\n<li>Lead security assessments for internal and customer security needs (e.g. SOC 2 Type II, ISO 27001, HIPAA audits).</li>\n</ul>\n<ul>\n<li>Maintain vulnerability and remediation documentation for auditors.</li>\n</ul>\n<ul>\n<li>Act as a liaison between product, engineering, compliance, and GTM to guide and prioritize the right security investments.</li>\n</ul>\n<ul>\n<li>Perform penetration tests, tabletop exercises, DR testing, and incident response.</li>\n</ul>\n<ul>\n<li>Manage endpoint security tooling as we scale; conduct audit log reviews and maintain visibility across our stack.</li>\n</ul>\n<p><strong>About You</strong></p>\n<ul>\n<li>3-5+ years in security engineering or operations.</li>\n</ul>\n<ul>\n<li>Deep knowledge of cloud security and expertise in operating in a cloud-hosted environment.</li>\n</ul>\n<ul>\n<li>Comfortable in compliance-heavy environments (SOC 2, ISO 27001, HIPAA).</li>\n</ul>\n<ul>\n<li>Strong experience with SIEM platforms (Splunk, Elastic, Panther) and vulnerability scanners (e.g. Qualys, Tenable, Rapid7).</li>\n</ul>\n<ul>\n<li>AI-forward with hands-on experience adopting, leveraging, and integrating AI tools.</li>\n</ul>\n<ul>\n<li>Startup mindset; you thrive building programs from the ground up and not just inheriting existing playbooks.</li>\n</ul>\n<ul>\n<li>Pragmatic and business-oriented, able to balance security rigor and business speed.</li>\n</ul>\n<ul>\n<li>Ability to communicate risk and technical ideas clearly to both technical and non-technical audiences.</li>\n</ul>\n<p><strong>Bonus Points</strong></p>\n<ul>\n<li>Experience with AI/ML infrastructure or inference platforms.</li>\n</ul>\n<ul>\n<li>Automation and scripting with Python.</li>\n</ul>\n<ul>\n<li>Healthcare data handling or BAA compliance experience.</li>\n</ul>\n<p style=\"margin-top:24px;font-size:13px;color:#666;\">XML job scraping automation by <a href=\"https://yubhub.co\">YubHub</a></p>","url":"https://yubhub.co/jobs/job_1d0184f1-be6","directApply":true,"hiringOrganization":{"@type":"Organization","name":"OpenRouter","sameAs":"https://jobs.ashbyhq.com","logo":"https://logos.yubhub.co/openrouter.com.png"},"x-apply-url":"https://jobs.ashbyhq.com/openrouter/188d9898-d4e0-4895-8203-86063af0ee41","x-work-arrangement":"Remote","x-experience-level":"mid","x-job-type":"Full time","x-salary-range":null,"x-skills-required":["cloud security","vulnerability scanning","SIEM platforms","vulnerability scanners","AI tools","endpoint security tooling"],"x-skills-preferred":["AI/ML infrastructure","inference platforms","Python scripting","healthcare data handling","BAA compliance"],"datePosted":"2026-03-09T09:48:01.907Z","jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Remote (US)"}},"jobLocationType":"TELECOMMUTE","employmentType":"FULL_TIME","occupationalCategory":"Engineering","industry":"Technology","skills":"cloud security, vulnerability scanning, SIEM platforms, vulnerability scanners, AI tools, endpoint security tooling, AI/ML infrastructure, inference platforms, Python scripting, healthcare data handling, BAA compliance"}]}