Senior SecOps Engineer

About Rethink First

Rethink First is a leading behavioral health technology company working to make mental wellness, education, and support accessible and scalable. Through our suite of cloud-based platforms—including Rethink Ed, Rethink Care, and Rethink

BH—we serve educators, employers, and providers with tools that deliver measurable, inclusive outcomes.

We're on a mission to make behavioral health more effective, equitable, and human—and we’re looking for a creative visionary to help lead that charge.

We’re seeking a Senior Security Operations (Sec Ops) Engineer to be responsible for engineering and improving the operational security foundation of the company — including automation, detection tuning, and incident readiness. This is an impact-driven, hands‑on technical role focused on building scalable defenses and readiness and reinforcing a security‑first culture.

You will partner closely with our SOC partner, acting as the technical and operational bridge to ensure high‑fidelity detections, meaningful escalations, and continuous reduction of alert noise. This is ideal for someone with a software or Sec Ops/Dev Ops background who has evolved into security engineering and wants to shape how security operations run at scale.

• Security Automation & Engineering
  • Design, build, and maintain automation workflows to eliminate manual Sec Ops tasks (Python, Power Shell, APIs, orchestration tools).
  • Integrate data and events from multiple sources (EDR, SIEM, cloud logs, vulnerability scanners, identity systems) to enhance visibility and context.
  • Develop reusable scripts, playbooks, and evidence collection automations to support compliance and incident response via aggregation tools and dashboarding.
• Third‑Party SOC Partnership
  • Serve as the primary technical interface between our internal team and the managed SOC provider.
  • Continuously refine alert logic, escalation paths, and severity classifications to reduce false positives.
  • Review and validate detections, ensuring coverage aligns with the company’s threat model and risk priorities.
  • Provide feedback and data to the SOC to tune detections and automate enrichment processes.
  • Conduct after‑action reviews with the SOC to improve handoffs and documentation quality.
• Incident Response & Readiness
  • Lead internal investigation and response when incidents are escalated from the SOC.
  • Build and maintain playbooks and runbooks for repeatable, automated responses.
  • Coordinate containment, root cause analysis, and lessons learned with cross‑functional teams.
  • Perform post‑incident analysis to improve detection rules and reduce future alert fatigue.
• Vulnerability & Threat Management
  • Manage the vulnerability lifecycle — scanning, prioritization, and coordination of remediation across IT and Engineering.
  • Correlate vulnerabilities with asset ownership and exposure context using automation.
  • Track and report remediation SLAs and provide risk‑based metrics to leadership.
• Cloud & Infrastructure Security
  • Partner with Dev Ops and engineering to implement automated guardrails and least‑privilege IAM policies.
  • Conduct reviews of cloud configurations (AWS, Azure, GCP) and recommend automated controls.
  • Build event‑driven detection and response functions using cloud‑native tools.
• Collaboration & Mentorship
  • Work closely with Compliance to provide evidence for audits (SOC 2, HITRUST).
  • Mentor junior security team members and offshore resources in automation, scripting, and incident response.
  • Advocate for “build once, automate forever” within security operations.

• 8+ years of experience in Sec Ops, Dev Ops, security engineering, or software development with an automation focus in SaaS environments.
• Proficient in scripting and automation (Python, Power Shell, etc) and integrating with APIs.
• Experience managing or collaborating with a managed security provider (MSSP/MDR/SOC).
• Strong grasp of SIEM and EDR ecosystems, including alert tuning and log analysis.
• Familiarity with cloud security (AWS, Azure) and infrastructure‑as‑code concepts.
• Excellent analytical, communication, and documentation skills.

• Background in software or…