Cloud Security Operations Engineer

The role

You will strengthen cloud detection and response practices by defending multi-cloud environments and leading incident investigations. You will build cloud detection coverage, develop tooling, and maintain SIEM, EDR, and SOAR systems.

What you will do

• Triage and investigate alerts across cloud-native tooling
• Detect and respond to cloud-specific threats
• Build detections on cloud audit logs, network flow logs, and telemetry
• Run proactive threat hunts using ATT&CK-aligned methods
• Build automation for cloud containment actions
• Lead incident response from scoping to post-incident review
• Build, tune, and maintain SIEM correlation rules and detection-as-code pipelines
• Own the health and reliability of the SecOps tooling estate
• Participate in the on-call rotation
• Maintain operational runbooks and contribute to red and purple team exercises

Required qualifications

• 4+ years in security engineering, SOC operations (T2/T3), or incident response within a complex enterprise environment
• 3+ years defending production cloud workloads
• Bachelors Degree (or equivalent experience) and/or 5 years of related experience
• Strong knowledge of cloud security architecture and telemetry in at least one major provider (AWS, Azure, or GCP)
• Deep understanding of cloud IAM and identity-based attack paths
• Hands-on experience investigating real cloud incidents using native cloud logs and forensic acquisition methods
• Experience with cloud-native threat detection services and with ingesting and normalizing cloud logs in a SIEM
• Working knowledge of core cloud infrastructure (compute, storage, networking, and serverless)
• Advanced proficiency with an enterprise SIEM
• Working command of MITRE ATT&CK
• Digital forensics experience across host, network, and memory artifacts
• Scripting in Python, PowerShell, or Bash

Nice to have

• CSPM/CNAPP or cloud workload protection experience (Wiz, Prisma Cloud, Defender for Cloud, Orca)
• Experience in multi-cloud environments
• Container and Kubernetes security (EKS, AKS, GKE)
• IaC for cloud guardrails and security configuration (Terraform, CloudFormation)
• SOAR experience (XSOAR, Splunk SOAR, Torq)
• Detection-as-code workflows with CI/CD integration and automated rule validation
• Relevant Professional Certifications: GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer

Benefits

• Corporate performance bonus
• Christmas bonus (Aguinaldo) per local requirements
• Medical
• Dental
• Vision
• Other local statutory benefits
• Mentoring and career development opportunities

About the company

Gainsight is the AI-powered retention engine behind the world’s most customer-centric companies. The Gainsight CustomerOS platform orchestrates the customer journey from onboarding to outcomes to advocacy.