Principal Security Engineer, Operations

The role

This person will own detection and response for the corporate environment. They will run and mature the SIEM, build detections, and drive incidents from signal through containment.

What you will do

• Own day-to-day detection and response across the corporate environment
• Administer and mature the SIEM
• Write, test, and maintain detection content mapped to MITRE ATT&CK
• Act as incident commander for corporate security incidents
• Build response playbooks and automation across SOAR, scripting, and vendor APIs
• Threat hunt proactively across endpoint, identity, SaaS, and cloud telemetry
• Run adversary emulation and purple team exercises
• Perform host, network, and cloud forensics across macOS, Windows, and Linux
• Investigate phishing, business email compromise, credential abuse, and insider risk
• Partner with IT and infrastructure teams to harden controls

Required qualifications

• 10+ years of experience in security operations, detection and response, or incident response
• Hands-on experience administering and tuning a SIEM
• Demonstrated experience leading security incidents end to end
• Strong working knowledge of attacker TTPs and the MITRE ATT&CK framework
• Experience investigating endpoint, identity, network, and cloud telemetry across macOS, Windows, and Linux
• 2+ years of development experience with any modern programming language used to automate detection, enrichment, and response, in lieu of a degree; OR a bachelor’s degree in security engineering, cyber
• Knowledge of operating systems, networking, cloud and SaaS platforms, security best practices, and log analysis at scale
• Comfortable working with mission critical and sensitive systems

Nice to have

• Bachelor’s degree (or equivalent) in computer science or engineering
• Detection and response certifications such as GCIH, GCFA, GCIA, GCDA, or OSCP, or equivalent hands-on experience
• Experience building detection-as-code pipelines, security data lakes, or ETL for security telemetry
• Experience with cloud detection and response in AWS, Azure, or GCP
• Experience with threat intelligence, malware analysis, or reverse engineering
• Experience protecting engineering, manufacturing, OT, or mission and ground segment environments
• Prior experience in a defense, aerospace, or other ITAR-regulated environment
• Security community contributions such as tooling, blog posts, conference talks, or CTFs

Benefits

• Paid time off
• Medical/dental/vision coverage
• Life insurance
• Paid parental leave
• Many other perks

Before you apply

• Must be a U.S. person as defined by 22 C.F.R. § 120.15 or otherwise eligible for a federally issued export control license

About the company

K2 is building the largest and highest-power satellites ever flown. They are mass-producing high-power satellite platforms for missions from LEO to deep space.