← All roles

Member of Technical Staff, SecOps & Threat Detection Engineer

Envoy· Research & Development
Apply on company site
San Francisco, CA$265k - $300kFull-timePosted 3mo ago

About the role

Staff Security Engineer responsible for designing and evolving Envoy's Security Operations and Threat Detection capabilities, with a focus on proactive detection, visibility, and automation across infrastructure, applications, and endpoints. On-site in San Francisco HQ with a 4-day workweek (Mon–Thu).

Responsibilities

  • Own the design and evolution of our threat detection and security operations capability
  • Define detection strategy across cloud infrastructure, applications, and endpoints
  • Establish and improve our SIEM and monitoring architecture, including signal quality, coverage, and scalability
  • Design and implement detection-as-code practices, setting standards for how detection logic is built, tested, and maintained
  • Drive visibility across all critical assets, ensuring endpoints, services, and identities are consistently monitored
  • Take ownership of endpoint security monitoring (e.g., SentinelOne), including integration into centralized detection workflows
  • Lead the design and rollout of automated security controls, including secrets rotation for high-risk systems
  • Define alerting strategy, including severity models, escalation paths, and on-call expectations
  • Lead investigations into complex or ambiguous security signals, setting the standard for root cause analysis and response
  • Partner with engineering teams to improve instrumentation and ensure systems emit high-quality security signals
  • Define and track key metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), and drive measurable improvements
  • Mentor and guide other engineers, raising the overall capability of the team in detection and security operations

Qualifications

  • 10+ years of experience in Security Engineering, SRE, or Infrastructure Engineering with a strong security focus
  • Proven experience designing or significantly improving security monitoring, detection, or SIEM systems
  • Strong understanding of cloud environments (ideally AWS), including IAM, networking, and logging at scale
  • Experience working with endpoint detection and response tools such as SentinelOne or similar
  • Deep experience working with logs, events, and telemetry to build meaningful, high-signal detections
  • Strong programming or scripting skills (Python, Go, or similar), with a focus on automation and system design
  • A strong understanding of attacker behavior and the ability to translate threats into detection strategies
  • Experience defining alerting models and reducing noise while maintaining strong coverage
  • Ability to operate in ambiguous environments and define structure where none exists
  • Strong cross-functional communication skills, with the ability to influence engineering and leadership
  • A pragmatic, outcome-oriented mindset focused on reducing real risk and improving operational effectiveness

Skills

Required:Threat detectionSIEMEndpoint security monitoringProgramming/scriptingCloud securityAlerting

Benefits

  • Market-competitive salary
  • Equity for all full-time roles
  • Excellent benefits
Last updated Sep 23, 2026. Interested? Apply on the company site.

About Envoy

Bring your workplace together with Envoy

Envoy brings everything you need to seamlessly and securely run your workplace into one, fully integrated and data-powered platform.

VisitorsWorkplaceEmergency NotificationsSecurityTrade complianceAnalyticsIntegrations
Company profileWebsite

More open roles at Envoy