[All remote jobs](https://jobicy.com/jobs.md)[![Fleetio logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/07/e571b83c37e0ed5371754d319be16e76.jpeg)](https://jobicy.com/company/fleetio.md)[Fleetio](https://jobicy.com/company/fleetio.md) # Senior Security Operations Engineer AI Summary Fleetio is hiring a Senior Security Operations Engineer to own corporate security operations across identity, endpoints, email, SaaS, data protection, and AI tooling. The role leads detection engineering, threat hunting, security automation, incident response, vulnerability management, and DLP program development. The engineer will work extensively with CrowdStrike, Okta, Mimecast, Google Workspace, SOAR workflows, REST APIs, and scripting. This is a senior hands-on role that requires independent risk decisions, cross-functional communication, and coordination with an external SOC, IT Operations, Compliance, and Product Security. The position is remote for candidates in the United States, Canada, and Mexico.[Apply for this job](#job-application)[View company](https://jobicy.com/company/fleetio.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md), [Canada](https://jobicy.com/job-region/canada.md), [Mexico](https://jobicy.com/job-region/mexico.md)SalaryUndisclosedDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished12 Nov 2026Apply before12 Dec 2026Listing views47Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. A little about us…[Fleetio](https://jobicy.com/company/fleetio.md) is a modern software platform that helps thousands of organizations worldwide manage their fleet operations. Transportation technology is a hot market, and we’re leading the charge with raving fans and new customers signing up every day. We raised $450M in our Series D funding round in March of 2025 and are on an exciting trajectory as a company. Fleetio is also a proud [founding member of the Rails Foundation](https://rubyonrails.org/foundation)! More about our team and company: * Fleetio overview video: [https://www.youtube.com/watch?v=YoXyXTFWbkg](https://www.youtube.com/watch?v=YoXyXTFWbkg) * Our careers page: [https://www.fleetio.com/careers](https://www.fleetio.com/careers) ### Description Our Business Technology team is looking for a Senior Security Operations Engineer to own the security of the tools, devices, identities, and data Fleetians rely on every day. You will help run corporate security operations end to end, covering detection and response, identity, endpoint, email, and SaaS security, data loss prevention, AI security, and vulnerability management, and make the day-to-day security calls that keep Fleetio safe. You will be hands-on: engineering controls, writing and tuning detections, automating response, and closing gaps, not just administering tools. The goal is one connected defense, not a collection of consoles: a signal from Okta, CrowdStrike, Mimecast, or Google Workspace should drive action in the others automatically, so the environment protects itself and people step in only where judgment is needed. Around-the-clock monitoring is handled by our external SOC (CrowdStrike Falcon Complete); this role engineers the environment it watches, owns what happens when it escalates, and extends what it can see. You will work closely with our IT Operations and Compliance teams, our 3rd party SOC, and the Product Security team in Platform Engineering. Our team treats AI as a core part of how we work. We build and use AI agents and automated workflows to handle toil, speed up investigation and response, and give our team more time for high-leverage work. ### Who You Are Our ideal candidate is a security engineer who likes to build. You are as comfortable writing a detection or a response playbook as you are working an incident. You think in systems: you see the gaps between tools and close them by wiring the tools together. You make sound security decisions on your own, explain them clearly to technical and non-technical people, and balance risk with how people actually work. You stay calm when something breaks. You can take a vague report, work out quickly what happened and who is affected, and give leaders a clear, evidence-backed answer. Then you fix the root cause so it doesn’t happen the same way twice. You’re curious about how AI is changing security operations, and you’re eager to put it to work on triage, enrichment, and response. ### Your Impact As a Senior Security Operations Engineer on Fleetio’s Business Technology team, you will: * Own detection engineering and threat hunting in CrowdStrike Next-Gen SIEM: onboard log sources, write and tune detections across identity, email, SaaS, and endpoint telemetry, and keep false positives down * Own security automation: chain our tools together through CrowdStrike Fusion SOAR and our workflow automation platform so a signal in one (a risky Okta sign-in, a Falcon detection, a Mimecast hit, a Google Workspace sharing change) triggers enrichment, containment, paging, and ticketing in the others, plus AI agents that speed up triage and investigation, so routine response runs without waiting on a human * Lead corporate incident response as technical lead, including third-party and supply-chain events: scope exposure quickly, confirm or rule out compromise, run forensics, tell leaders and employees what to do, keep runbooks current with Product Security, and serve in the escalation rotation, backing up the Incident Commander when needed * Own CrowdStrike Falcon configuration and detections, manage the Falcon Complete relationship and escalations, and maintain device trust checks and an inventory of software and extensions on company devices with clear guidance on approved tools * Own Okta authentication policy, MFA, session policy, and privileged access management, and automate user access reviews and audit evidence with Compliance so SOC 2 controls run with less manual effort * Own Mimecast policy, secure network access, Google Workspace and key SaaS security settings, and SaaS security posture in CrowdStrike Falcon Shield, driving findings to closure with app owners * Own data loss prevention: define and classify Fleetio’s sensitive data, design and tune DLP policies across email (Mimecast), Google Workspace, endpoints (CrowdStrike), and key SaaS apps, and investigate and respond to data exposure, whether from accidental oversharing, a compromised account, or insider misuse * Own security for Fleetio’s use of AI: visibility into AI tool usage, identity and access for AI agents, guardrails for internal agents and automations, and AI detection and response (CrowdStrike Falcon Guardian, formerly AIDR) * Run vulnerability management for corporate assets, prioritizing by exploitability and holding owners to fix deadlines, and report on security posture with clear, honest metrics that help set program priorities ### Your Experience * 5+ years of experience in security operations, detection and response, or security engineering, ideally at a SaaS company * Detection engineering and threat hunting in a SIEM (CrowdStrike Next-Gen SIEM or similar) * Security automation: building SOAR playbooks (CrowdStrike Fusion or similar) that connect identity, endpoint, email, and SaaS tools into a single response flow, with Python or PowerShell and REST APIs * Incident response from first triage through forensics, root cause, and follow-up across cloud, identity, and SaaS environments, including working with an MDR or managed SOC provider * Identity security with Okta or a similar provider: authentication policy, privileged access, and access reviews in a SOC 2 or ISO 27001 control environment * Endpoint security with CrowdStrike or similar, including macOS, plus device trust and endpoint query tooling * Email security (Mimecast or similar) and SaaS security posture management * Designing and running a DLP program: data classification, policy design and tuning across email, cloud collaboration, and endpoints, and investigating data exposure * Securing developer tooling and the software supply chain (IDE extensions, package registries, AI coding tools) * Excellent written and verbal communication skills, including explaining risk to non-technical leaders ### Considered a Plus * Experience securing a company’s use of AI: AI tool governance, identity and access for agents, data-exposure and prompt-injection risk, and AI detection and response tooling (CrowdStrike Falcon Guardian/AIDR or similar) * Experience building AI agents, LLM-powered automations, or integrations (e.g., using tool/function calling or MCP) for security operations workflows * Experience using LLMs on real security alerts for triage, enrichment, and investigation ### Benefits * Multiple health/dental coverage options (100% coverage for employee, 50% for family) * Vision insurance * Incentive stock options * 401(k) match of 4% * PTO – 4 weeks (increases at year two!) * 12 company holidays + 2 floating holidays * Parental leave – birthing parent (16 weeks paid) non-birthing (4 weeks paid) * FSA & HSA options * Short and long term disability (short term 100% paid) * Community service funds * Professional development funds * Wellbeing fund – $150 quarterly * Business expense stipend – $125 quarterly * Mac laptop + new hire equipment stipend * Fully stocked kitchen with tons of drinks & snacks (BHM only) * Remote working friendly since 2012 #LI-Remote Fleetio provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment. We celebrate diversity and are committed to creating an inclusive environment for all. All employment is decided on the basis of qualifications, merit and business need. This application is not intended to and does not create a contract or offer of employment. Employment with Fleetio is at will. If you have a disability or a special need that requires an accommodation to fill out the online application, please let us know by calling (205) 718-7500. Show more [Apply now >](https://jobicy.com/jobs/161527-senior-security-operations-engineer-5.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a broad senior security role with end-to-end ownership of high-impact controls and incident response. It requires deep technical expertise across multiple security domains while making independent, time-sensitive risk decisions. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$155,000US market range (per year)$135k–$185k0$203.50k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. No employer base salary was disclosed. The annual period is inferred from the senior full-time security engineering role and North American market conventions. Estimated annual market compensation is USD 135,000 to USD 185,000, with an estimated midpoint of USD 155,000; these are AI estimates rather than verified employer compensation. ## Core skills Skills and capabilities most closely associated with this opportunity. [Security operations](https://jobicy.com/jobs?search_keywords=Security%20operations.md)[Detection engineering](https://jobicy.com/jobs?search_keywords=Detection%20engineering.md)[Threat hunting](https://jobicy.com/jobs?search_keywords=Threat%20hunting.md)[Incident response](https://jobicy.com/jobs?search_keywords=Incident%20response.md)[CrowdStrike Falcon](https://jobicy.com/jobs?search_keywords=CrowdStrike%20Falcon.md)[SIEM](https://jobicy.com/jobs?search_keywords=SIEM.md)[SOAR automation](https://jobicy.com/jobs?search_keywords=SOAR%20automation.md)[Okta](https://jobicy.com/jobs?search_keywords=Okta.md)[Identity and access management](https://jobicy.com/jobs?search_keywords=Identity%20and%20access%20management.md)[Data loss prevention](https://jobicy.com/jobs?search_keywords=Data%20loss%20prevention.md)[Vulnerability management](https://jobicy.com/jobs?search_keywords=Vulnerability%20management.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[PowerShell](https://jobicy.com/jobs?search_keywords=PowerShell.md)[REST APIs](https://jobicy.com/jobs?search_keywords=REST%20APIs.md)[SaaS security](https://jobicy.com/jobs?search_keywords=SaaS%20security.md) Sample interview questionsHow would you design an automated response flow for a risky Okta sign-in event?I would first enrich the event with user, device, IP, geolocation, recent activity, and endpoint telemetry. Based on a risk threshold, the SOAR workflow could revoke sessions, require MFA reauthentication, temporarily suspend access, open a ticket, page the appropriate team, and preserve evidence for review. I would include approval gates for high-impact actions and continuously tune the workflow using incident outcomes. Describe your approach to reducing false positives in SIEM detections. I start by defining the detection objective, expected attacker behavior, and available telemetry. I tune rules using baselines, asset and identity context, allowlists with expiration and ownership, and correlation with other security signals. I measure alert precision and analyst feedback over time so rules remain useful as the environment changes. How would you respond to a suspected data exposure in Google Workspace? I would quickly determine the affected data, sharing scope, users, external recipients, and whether the exposure is ongoing. Immediate actions may include removing external access, revoking sessions or tokens if compromise is suspected, preserving audit evidence, and engaging legal or compliance stakeholders as appropriate. After containment, I would identify the root cause and improve DLP policies, sharing controls, training, or automation to prevent recurrence. What factors do you use to prioritize vulnerabilities on corporate endpoints? I prioritize based on active exploitation, exploitability, internet exposure, affected asset criticality, privilege level, compensating controls, patch availability, and business impact. A vulnerability on an exposed privileged system with known exploitation would take precedence over a low-impact issue on a managed, isolated endpoint. I also establish clear remediation SLAs and report overdue risk to accountable owners. How would you apply AI safely to security operations workflows? I would use AI for bounded tasks such as alert summarization, enrichment, investigation support, and draft response recommendations while retaining human approval for material containment decisions. Controls should include least-privilege access, protected handling of sensitive data, logging, prompt-injection defenses, output validation, and clear auditability. I would evaluate accuracy and operational impact before expanding automation scope. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Dropbox logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/09/WRILS-200923071227-398427.jpg) Dropbox Nov 12 New ### [Security Engineer, IAM](https://jobicy.com/jobs/161544-security-engineer-iam.md) Role Description Security Engineers at Dropbox safeguard our digital ecosystem alongside a diverse team of professionals dedicated to protecting our products and users. Trusted by millions, our mission is to… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 12 New ### [Senior Blockchain Intelligence Analyst, Ransomware](https://jobicy.com/jobs/155136-senior-blockchain-intelligence-analyst-ransomware.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Nov 12 New ### [Security Operations Analyst- Ireland](https://jobicy.com/jobs/155141-security-operations-analyst-ireland.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Nov 12 New ### [Blockchain Security Expert – Chain Security Evaluation Track](https://jobicy.com/jobs/152970-blockchain-security-expert-chain-security-evaluation-track.md) About You You’re a self-starter who thrives on tackling the toughest and most meaningful problems, even if they are the most difficult problems. You’re comfortable with the unknown and understand… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Nov 12 New ### [Blockchain Security Expert – Anti Defect Track](https://jobicy.com/jobs/152966-blockchain-security-expert-anti-defect-track.md) About the Company Founded in 2018 by professors of Yale University and Columbia University, CertiK is a pioneer in blockchain security, utilizing best-in-class AI technology to secure and monitor blockchain… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Nov 12 New ### [Blockchain Security Expert – Security Audit Track](https://jobicy.com/jobs/152975-blockchain-security-expert-security-audit-track.md) About You You’re a self-starter. You believe in tackling the most important problems, even if they are the most difficult problems. You’re comfortable with the unknown and understand that #startuplife… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Nov 12 New ### [Blockchain Security Expert Intern – AI Track](https://jobicy.com/jobs/152979-blockchain-security-expert-intern-ai-track.md) About the Company Founded in 2018 by professors of Yale University and Columbia University, CertiK is a pioneer in blockchain security, utilizing best-in-class AI technology to secure and monitor blockchain… * ![Five9 logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/7c3d754e-221.png) Five9 Nov 12 New ### [Staff Information Security Engineer](https://jobicy.com/jobs/155070-staff-information-security-engineer.md) Join us in bringing joy to customer experience. Five9 is a leading provider of cloud contact center software, bringing the power of cloud innovation to customers worldwide. Living our values… * ![Synthesia logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/c69aad11-221.webp) Synthesia Nov 12 New ### [SecOps Security Engineer (Staff-level, L6)](https://jobicy.com/jobs/152968-secops-security-engineer-staff-level-l6.md) Synthesia is the world’s leading AI video platform for business, used by over 90% of the Fortune 100. Founded in 2017, the company is headquartered in London, with offices and… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Nov 11 New ### [Security Analyst, Governance and Trust](https://jobicy.com/jobs/161420-security-analyst-governance-and-trust-2.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… [Browse all jobs](https://jobicy.com/jobs.md)