Security Operations Engineer

Description About Cyera Come join the company building the security operating model for the age of AI. AI has changed how data is used — and security must change with it. Cyera's mission is to empower businesses to accelerate AI Adoption by defining a holistic approach to securing AI - from data to access to model. Instead of perimeter controls and static policies, Cyera provides a unified control plane that understands relationships between data, access, and behaviors across humans, systems, and AI. Backed by the world's leading investors and working with a large and growing list of Fortune 1000 companies, we are looking for world-class talent to join us as we usher in the new era of data and AI security. About the Role Join our team as a Security Operations Engineer . You will own escalated investigations end to end, lead the response to moderate-scope incidents, and improve the detections, playbooks, and automations behind our agentic SOC. This is a role for someone who wants to spend more of their time improving the system than working the queue. You will also own a domain of our customer zero program, operating the Cyera platform in our own environment and turning operator experience into product feedback. You will also help newer Security Operations Engineers grow. You will join a team that is building a modern, AI-assisted SOC from the ground up at a fast-growing data and AI security company. Your work will directly shape how we detect and respond, how our agents operate, and how our product behaves. The ideal candidate has 2 to 4 years of experience in security operations or incident response, has led real incidents, writes production-quality Python, and is comfortable building and tuning detections. What you’ll do • Investigation Ownership: Own escalated investigations from triage to closure, including correlation, scoping, and remediation coordination. • Incident Response: Lead moderate-scope incidents, serve as a core responder on major incidents, and write after-action reports. • Detection Engineering: Build and tune detections across cloud, identity, SaaS, and endpoint telemetry, with test cases and documented rationale. • SOC Automation: Improve agent workflows, enrichment, and playbooks, and measure the effect on autonomous handling and time to resolution. • Customer Zero: Own a domain of our internal Cyera deployment: posture goals, remediation with data owners, and prioritized product feedback. • Threat Hunting: Run hypothesis-driven hunts and convert findings into detections or automations. • Mentorship: Review the work of newer Security Operations Engineers, pair on investigations, and help them build engineering habits. What You’ll Bring • Experience: 2 to 4 years in security operations, incident response, or detection engineering. • Incident Response: Experience leading or co-leading incidents, including containment decisions and post-incident write-ups. • AWS Knowledge: Working knowledge of AWS security services, IAM, logging, and common cloud attack paths. • AWS Certification: AWS Certified Cloud Practitioner required; Security Specialty or Solutions Architect Associate preferred. • Python: Hands-on proficiency, with automation others rely on. • SIEM and Detection: Experience building, tuning, and maintaining detections and investigating from raw logs. • Communication: Can write a clear incident report and brief a non-technical stakeholder. Nice to have: • AI Workflows: Hands-on work with LLM applications, agent frameworks, or AI-assisted security operations. • Detection Languages: Sigma, SQL, KQL, SPL, YARA, or similar. • Data Security: Experience with DSPM, DLP, or data access governance. • Infrastructure as Code: Terraform, CloudFormation, or CDK. • Certifications: GCIH, GCIA, GCFA, AWS Security Specialty, or similar.