Member of Technical Staff, SecOps & Threat Detection Engineer
Envoy · San Francisco, CA
About this role
**Member of Technical Staff, SecOps & Threat Detection Engineer** Envoy protects the places the world relies on most by unifying people, spaces, and communications in one secure, integrated workplace management platform. With 16,000+ workplaces worldwide, we help customers run secure, compliant, and connected operations across every location. Great experiences bring great security—and we’re building an engineering-led security function focused on **threat detection, visibility, and automation**. --- ## About the role We’re looking for a **Staff Security Engineer** to own and evolve our **Security Operations and Threat Detection** capabilities. This role will lead the shift from a mostly **reactive** security posture to a system where detection is **reliable, measurable, and engineered**. You’ll work across **Infrastructure, Platform, and Workplace** teams to ensure we have full visibility and can confidently answer: > “If we had a security incident, how quickly would we know?” **On-site:** 4 days/week (Monday–Thursday) in our **San Francisco HQ**. --- ## You will - Own the design and evolution of our **threat detection** and **security operations** capability - Define detection strategy across **cloud infrastructure, applications, and endpoints** - Establish and improve our **SIEM and monitoring architecture** (signal quality, coverage, scalability) - Design and implement **detection-as-code** practices (standards for building, testing, and maintaining detection logic) - Drive visibility across critical assets—ensuring **endpoints, services, and identities** are consistently monitored - Own **endpoint security monitoring** (e.g., **SentinelOne**) and integrate it into centralized detection workflows - Lead design and rollout of **automated security controls** (including secrets rotation for high-risk systems) - Define **alerting strategy** (severity models, escalation paths, on-call expectations) - Lead investigations into complex/ambiguous security signals (standardizing root cause analysis and response) - Partner with engineering teams to improve **instrumentation** and ensure high-quality security signals - Define and track key metrics such as **MTTD** (Mean Time to Detect) and **MTTR** (Mean Time to Respond), driving measurable improvements - Mentor and guide engineers to raise team capability in detection and security operations --- ## You have - **10+ years** experience in Security Engineering, SRE, or Infrastructure Engineering with a strong security focus - Proven experience designing or significantly improving **security monitoring, detection, or SIEM** systems - Strong understanding of **cloud environments** (ideally **AWS**), including **IAM, networking, and logging at scale** - Experience with endpoint detection/response tools such as **SentinelOne** (or similar) - Deep experience working with **logs, events, and telemetry** to build high-signal detections - Strong programming/scripting skills (e.g., **Python, Go**) focused on automation and system design - Strong understanding of **attacker behavior** and translating threats into detection strategies - Experience defining **alerting models** and reducing noise while maintaining strong coverage - Ability to operate in ambiguous environments and create structure where none exists - Strong cross-functional communication skills; ability to influence engineering and leadership - Pragmatic, outcome-oriented mindset focused on reducing real risk and improving operational
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.