Staff Security Engineer, Security Operations

A staff security engineer leading security operations at GoodLeap, based at its Roseville headquarters. The engineer builds detections as code across cloud, identity, endpoint and email mapped to MITRE ATT&CK, manages SIEM and logging pipelines, leads incident response including regulatory notification work with legal, and runs tabletops and post-incident reviews.

The role also owns CrowdStrike EDR and email security, builds AI agents for alert triage and response, sets up monitoring of employee AI tools, agents and MCP integrations, and mentors the team. It needs deep AWS security knowledge, hands-on detection engineering and incident response, Python automation, LLM agent experience and work in SOC 2, PCI or ISO environments.