Member of Technical Staff, SecOps & Threat Detection Engineer

The role

This role owns and evolves threat detection and security operations capabilities. You will define detection strategies across cloud infrastructure, applications, and endpoints to shift security from reactive to engineered.

What you will do

• Own the design and evolution of threat detection and security operations capability
• Define detection strategy across cloud infrastructure, applications, and endpoints
• Establish and improve SIEM and monitoring architecture
• Design and implement detection-as-code practices
• Drive visibility across all critical assets
• Take ownership of endpoint security monitoring
• Lead the design and rollout of automated security controls
• Define alerting strategy, including severity models, escalation paths, and on-call expectations
• Lead investigations into complex or ambiguous security signals
• Partner with engineering teams to improve instrumentation

Required qualifications

• 10+ years of experience in Security Engineering, SRE, or Infrastructure Engineering with a strong security focus
• Proven experience designing or significantly improving security monitoring, detection, or SIEM systems
• Strong understanding of cloud environments (ideally AWS), including IAM, networking, and logging at scale
• Experience working with endpoint detection and response tools such as SentinelOne or similar
• Deep experience working with logs, events, and telemetry to build meaningful, high-signal detections
• Strong programming or scripting skills (Python, Go, or similar), with a focus on automation and system design
• A strong understanding of attacker behavior and the ability to translate threats into detection strategies
• Experience defining alerting models and reducing noise while maintaining strong coverage
• Ability to operate in ambiguous environments and define structure where none exists
• Strong cross-functional communication skills, with the ability to influence engineering and leadership
• A pragmatic, outcome-oriented mindset focused on reducing real risk and improving operational effectiveness

Nice to have

• AWS

About the company

Envoy protects workplaces by unifying people, spaces, and communications in a secure, integrated workplace management platform and ecosystem. More than 16,000 workplaces around the world trust Envoy to run secure, compliant, and connected operations.