[All remote jobs](https://jobicy.com/jobs.md)[![Goodleap logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/482c4fb7-221.png)](https://jobicy.com/company/goodleap.md)[Goodleap](https://jobicy.com/company/goodleap.md) # Staff Security Engineer, Security Operations AI Summary GoodLeap is seeking a staff-level security operations engineer to protect cloud, application, endpoint, identity, and email environments. The role owns detection engineering, incident response leadership, SIEM and logging pipelines, and operational security tooling including CrowdStrike. It also requires building AI-driven triage and response automation while monitoring enterprise AI tools, agents, integrations, and API-key activity. The engineer will act as an AWS security subject-matter expert, improve incident readiness, assess risk, and mentor security and engineering partners. This is a senior individual-contributor role combining hands-on technical execution with security-program leadership.[Apply for this job](#job-application)[View company](https://jobicy.com/company/goodleap.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 167,400–265,200 / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished8 Nov 2026Apply before8 Dec 2026Listing views58Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. About [GoodLeap](https://jobicy.com/company/goodleap.md): GoodLeap is a technology company delivering best-in-class financing and software products for sustainable solutions, from solar panels and batteries to energy-efficient HVAC, heat pumps, roofing, windows, and more. Over 1 million homeowners have benefited from our simple, fast, and frictionless technology that makes the adoption of these products more affordable, accessible, and easier to understand. Thousands of professionals deploying home efficiency and solar solutions rely on GoodLeap’s proprietary, AI-powered applications and developer tools to drive more transparent customer communication, deeper business intelligence, and streamlined payment and operations. Our platform has led to more than $30 billion in financing for sustainable solutions since 2018. GoodLeap is also proud to support our award-winning nonprofit, GivePower, which is building and deploying life-saving water and clean electricity systems, changing the lives of more than 1.6 million people across Africa, Asia, and South America. ### Position Summary The Staff Security Engineer, Security Operations is responsible for protecting GoodLeap’s cloud environments, applications, endpoints, and corporate systems through detection engineering, incident response, and security operations. This role builds and tunes detections, leads investigation and response for security incidents, and manages the security tooling that provides visibility across cloud, identity, endpoint, and email. The Staff Security Engineer will design and build AI agents and automation that reduce time-to-detect and time-to-respond, and will establish monitoring of AI activity across the enterprise, including AI tools, agents, and integrations used by employees and engineering teams. This role works closely with software engineers, infrastructure, IT, and compliance partners to ensure security controls are consistently applied and operationally effective. Additionally, the Staff Security Engineer develops security requirements, conducts security risk assessments, evaluates security services and technologies, maintains incident response plans and runbooks, and provides mentoring to the security team and partner engineering teams. This role will own endpoint detection and response (CrowdStrike) and email security as these capabilities are brought into the security function. ### Essential Job Duties and Responsibilities Detection Engineering & Monitoring * Design, build, test, and tune detections across cloud, identity, endpoint, and email telemetry using detection-as-code practices mapped to MITRE ATT&CK. * Manage security logging, SIEM, and alerting pipelines. * Establish monitoring of AI activity, including AI tools, agents, MCP integrations, and API keys, to detect data exposure, misuse, and anomalous behavior. * Reduce time-to-detect through applied threat intelligence and sensor enrichment. Incident Response * Lead investigation, containment, eradication, and recovery for security incidents. * Serve as incident lead for significant events and coordinate with legal, compliance, and leadership on regulatory notification obligations. * Maintain incident response plans, playbooks, and runbooks. * Conduct tabletop exercises and post-incident reviews that drive lasting control improvements. Security Tooling, Automation & AI Agents * Deploy and manage the security operations toolset, including cloud security monitoring, WAF, DDoS protection, IDS, EDR (CrowdStrike), and email security. * Build AI agents and automation for alert triage, enrichment, investigation, and response. * Review results from vulnerability scans, penetration testing, and other sources for true positives and propose remediation or mitigating controls. * Serve as a subject matter expert (SME) on AWS cloud security and consult on the secure design of cloud-based systems. Mentorship & Leadership * Provide mentorship and guidance to the security team and partner engineering teams on detection, response, and security operations practices. * Share in-depth understanding of company and industry methodologies, policies, standards, and controls. * Help build the security team and lead efforts to mature GoodLeap’s security operations capability. ### Required Skills, Knowledge and Abilities * In-depth knowledge of Amazon AWS, including security configuration, logging, and tooling (e.g., CloudTrail, GuardDuty, Security Hub). * Hands-on experience in detection engineering, including SIEM query languages and detection-as-code. * Hands-on experience in incident response, including log analysis and host and cloud investigation. * Familiar with the MITRE ATT&CK framework and OWASP Top 10. * Knowledge of network and web related protocols (e.g., TCP/IP, DNS, HTTP, HTTPS, TLS). * Experience with, or ability to quickly ramp on, EDR platforms (CrowdStrike Falcon preferred). * Experience with, or ability to quickly ramp on, email security (phishing, BEC, DMARC/SPF/DKIM). * Experience building automation in Python or a similar language. * Experience building or integrating LLM-based agents and workflows. * Understanding of AI-specific risks such as prompt injection, data leakage, and excessive agent permissions. * Experience working in a SOC 2, PCI-DSS, or ISO control environment. * Proven ability to combine business acumen, technical acumen, and process expertise to assess requirements and alignment. * Strong communicator across verbal, written, ticketing, and messaging channels. * Able to prioritize and deliver on multiple tasks independently with a strong bias toward action in a fast-paced environment. * GCIH, GCFA, GCDA, CCSP, CISSP, CrowdStrike, or comparable certifications are a plus. ### Compensation Base pay range (CA, WA, NJ, MA, DC, NYC) per year: $184,100 – $231,700 Base pay range (all other US locations) per year: $167,400 – $210,600 Base pay range (SF Bay Area) per year: $210,200 – $265,200 In addition to the above salary, this role may be eligible for a bonus and equity. ### Additional Information Additional Information Regarding Job Duties and Job Descriptions: Job duties include additional responsibilities as assigned by one’s supervisor or other managers related to the position/department. This job description is meant to describe the general nature and level of work being performed; it is not intended to be construed as an exhaustive list of all responsibilities, duties and other skills required for the position. The Company reserves the right at any time with or without notice to alter or change job responsibilities, reassign or transfer job position or assign additional job responsibilities, subject to applicable law. The Company shall provide reasonable accommodations of known disabilities to enable a qualified applicant or employee to apply for employment, perform the essential functions of the job, or enjoy the benefits and privileges of employment as required by the law. If you are an extraordinary professional who thrives in a collaborative work culture and values a rewarding career, then we want to work with you! Apply today! We are committed to protecting your privacy. To learn more about how we collect, use, and safeguard your personal information during the application process, please review our [Employment Privacy Policy](https://www.goodleap.com/employment-privacy) and [Recruiting Policy on AI](https://www.goodleap.com/recruiting-policy-on-ai). Show more [Apply now >](https://jobicy.com/jobs/159659-staff-security-engineer-security-operations.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThe position requires deep practical expertise across AWS, detection-as-code, incident response, endpoint and email security, plus emerging AI-agent security risks. The successful candidate must independently lead high-impact incidents and influence engineering, legal, compliance, and leadership stakeholders. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$216,300US market range (per year)$180k–$280k0$308k AI insightThe employer discloses a USD annual base-pay range of $167,400–$265,200, varying by US location. The overall midpoint is $216,300 per year; bonus and equity may be available separately. Estimated US market base pay for a staff-level security operations engineer is $180,000–$280,000 annually. ## Core skills Skills and capabilities most closely associated with this opportunity. [AWS security](https://jobicy.com/jobs?search_keywords=AWS%20security.md)[Detection engineering](https://jobicy.com/jobs?search_keywords=Detection%20engineering.md)[SIEM](https://jobicy.com/jobs?search_keywords=SIEM.md)[Incident response](https://jobicy.com/jobs?search_keywords=Incident%20response.md)[MITRE ATT&CK](https://jobicy.com/jobs?search_keywords=MITRE%20ATTCK.md)[CrowdStrike Falcon](https://jobicy.com/jobs?search_keywords=CrowdStrike%20Falcon.md)[Email security](https://jobicy.com/jobs?search_keywords=Email%20security.md)[Python automation](https://jobicy.com/jobs?search_keywords=Python%20automation.md)[LLM agents](https://jobicy.com/jobs?search_keywords=LLM%20agents.md)[CloudTrail](https://jobicy.com/jobs?search_keywords=CloudTrail.md)[GuardDuty](https://jobicy.com/jobs?search_keywords=GuardDuty.md)[Security Hub](https://jobicy.com/jobs?search_keywords=Security%20Hub.md)[Threat intelligence](https://jobicy.com/jobs?search_keywords=Threat%20intelligence.md)[Security operations](https://jobicy.com/jobs?search_keywords=Security%20operations.md)[SOC 2 compliance](https://jobicy.com/jobs?search_keywords=SOC%202%20compliance.md) Sample interview questionsHow would you design a detection-as-code program for AWS, identity, endpoint, and email telemetry?I would define priority threat scenarios mapped to MITRE ATT&CK, standardize event schemas and detection repositories, and use version control, peer review, automated testing, and staged deployment. I would measure alert fidelity, coverage, and time-to-detect, then continuously tune rules using incident findings and threat intelligence. Describe your approach to leading a significant cloud security incident. I would first establish scope, severity, ownership, and a communication cadence. I would preserve evidence, contain affected accounts or workloads, investigate logs and identities, eradicate the root cause, and coordinate recovery with engineering and IT. Afterward, I would lead a blameless review with clear corrective actions, owners, and validation dates. What security controls would you use to monitor enterprise AI agents and LLM integrations? I would inventory approved tools, agents, MCP integrations, API keys, data sources, and permissions. Controls would include centralized audit logging, secrets management, least-privilege access, data classification and egress monitoring, anomaly detections, prompt-injection testing, and review gates for new integrations. How would you improve the signal quality of a noisy SIEM alert? I would examine historical alert outcomes, identify recurring benign patterns, and validate the telemetry quality. I would enrich the rule with asset criticality, identity context, threat intelligence, and behavioral thresholds, then test changes against historical data before deployment. I would retain enough sensitivity to detect meaningful variants while documenting any accepted residual risk. How do you communicate security risk to engineering and executive stakeholders? I tailor the message to the audience: engineers receive reproducible evidence, technical remediation steps, and acceptance criteria, while executives receive business impact, likelihood, decisions needed, and timelines. I prioritize risks using exploitability, exposure, data sensitivity, and operational impact, then track remediation transparently to closure. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![1Password logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/09/WRILS-200909195848-296323.png) 1Password Nov 8 New ### [Senior IT Engineer, Identity and Access Management](https://jobicy.com/jobs/159753-senior-it-engineer-identity-and-access-management.md) 1Password is growing. We’ve surpassed $500M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up… * ![Discord logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/02/WRILS-210216185819-522054.jpg) Discord Nov 8 New ### [Engineering Manager, Platform Security](https://jobicy.com/jobs/154856-engineering-manager-platform-security.md) Discord has a highly engaged community of millions of daily active users who use the platform for many different reasons, but there’s one thing that nearly everyone does: play video… * ![HackerOne logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/8937d355-221.png) HackerOne Nov 8 New ### [Senior Security Engineer, Identity and Access Management](https://jobicy.com/jobs/154842-senior-security-engineer-identity-and-access-management.md) HackerOne is a global leader in Continuous Threat Exposure Management (CTEM). The HackerOne Platform unites agentic AI solutions with the ingenuity of the world’s largest community of security researchers to… * ![Elevenlabs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e01b4c5d-221.png) Elevenlabs Nov 8 New ### [Safety Engineer – Free Tier Abuse](https://jobicy.com/jobs/154823-safety-engineer-free-tier-abuse.md) About ElevenLabs ElevenLabs is an AI research and product company transforming how we interact with technology. We launched in January 2023 with the first human-like AI voice model. Today, we… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 8 New ### [Senior / Staff Threat Intelligence Analyst, Hacks](https://jobicy.com/jobs/154835-senior-staff-threat-intelligence-analyst-hacks.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![Tenable logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/01879e02-221.jpg) Tenable Nov 8 New ### [Principal Solutions Architect (AWS Technical Alliances)](https://jobicy.com/jobs/152664-principal-solutions-architect-aws-technical-alliances.md) Who is Tenable? Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent… * ![Upside logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/06e64944-221.png) Upside Nov 8 New ### [Staff Application Security Engineer](https://jobicy.com/jobs/152657-staff-application-security-engineer.md) Meet Upside: We created Upside to transform brick-and-mortar commerce. Our technology uses the sophistication of online retail—profit measurement, attribution, and incrementality—to provide users with more value on their everyday purchases… * ![Databricks logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/12/4e3f864ba9cf3c62d471e1c62414d098.jpg) Databricks Nov 7 New ### [Sr. Staff Security Software Engineer – Agentic Security Engineering](https://jobicy.com/jobs/159516-sr-staff-security-software-engineer-agentic-security-engineering.md) RDQ327R179 While candidates in the listed location(s) are encouraged for this role, candidates in other (US) locations will be considered. About the Team The Agentic Security Engineering team is a… * ![Databricks logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/12/4e3f864ba9cf3c62d471e1c62414d098.jpg) Databricks Nov 7 New ### [Sr. Security Engineer, Enterprise Security](https://jobicy.com/jobs/159508-sr-security-engineer-enterprise-security.md) RDQ427R608 While candidates in the listed location(s) are encouraged for this role, candidates in other US locations will be considered. — About the Team The Enterprise Security team at Databricks… * ![Databricks logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/12/4e3f864ba9cf3c62d471e1c62414d098.jpg) Databricks Nov 7 New ### [Sr. Manager, Security — Continuous Monitoring v 2.0](https://jobicy.com/jobs/159505-sr-manager-security-continuous-monitoring-v-2-0.md) RDQ227R1175 While candidates in the listed location(s) are encouraged for this role, candidates in other locations will be considered. About Databricks Databricks is the data and AI company. More than… [Browse all jobs](https://jobicy.com/jobs.md)