Senior Engineer, IT - SecOps

We are Builders First Source, America's largest supplier of building materials, value‑added components and building services to the professional market. You’ll feel proud of the work you do here every day to transform the future of home building and help make the dream of home ownership more achievable. At BFS, we believe building a successful career is not solely defined by a degree.

Your experience, skills and passion are just as important, if not more so.

Senior Engineers must be capable of operating without direct oversight. They must also possess a sufficient depth of experience and knowledge in IT and security to be responsible for performing complex engineering tasks, including tool testing, deployment, maintenance, troubleshooting and enhancements. They must support intrusion detection and incident response activities, including threat hunting, leading IR engagements and performing forensics as needed.

Strong oral and written communication skills are required, as is the ability to interface with senior personnel across the IT organization and develop detailed process and technical documentation. As a senior member of the Sec Ops team, Senior Engineers will provide mentorship, support and training to Engineers as needed.

We’re seeking a hands‑on Security Operations Engineer who thrives in a 24x7 environment and can detect, analyze and respond to cyber threats in real time. This role’s primary focus is SOC monitoring and incident response; the secondary focus includes security engineering work to mature detections, tune tooling, automate workflows and harden the environment.

• Monitor SIEM/XDR/SOAR and other telemetry for alerts, anomalies and indicators of compromise (IOCs).
• Perform Level 1‑2 triage, enrichment, scoping and prioritization of events.
• Execute response playbooks (isolation, containment, account/device quarantine, EDR actions, network blocks).
• Lead or support incident investigations (forensics acquisition, timeline analysis, root cause).
• Document incidents thoroughly (IR tickets, evidence handling, post‑incident reports).
• Conduct proactive hunts using hypotheses tied to current TTPs (e.g., MITRE ATT&CK).
• Draft, test and deploy high‑fidelity detections and correlation rules; reduce alert noise.
• Operationalize threat intel (IOCs, behavioral analytics) into monitoring and detections.
• Track and respond to emerging threats and vulnerabilities impacting our stack.
• Maintain shift logs, knowledge base updates, runbooks and handoffs.

• Support deployment, configuration and maintenance of SIEM/XDR/SOAR, IDS/IPS, e‑mail security, WAF, CASB, DLP, PAM and endpoint security platforms.
• Build and maintain data sources, parsers/normalization, health checks and content packs.
• Implement security baselines, hardening guides and secure configurations across endpoints, servers, cloud and network devices.
• Integrate cloud telemetry (AWS/GCP/Azure), identity signals (Entra /Okta/AD) and SaaS logs into monitoring with robust detections.

This job has no supervisory responsibilities.

• 5+ years relevant work experience.
• Or an equivalent combination of experience and education.
• Clear written and verbal communication, decision‑making under pressure and strong collaboration across IT and business teams.
• Ability to work independently on shift and drive incidents to closure.

• Certifications:
  
  GCIA, GMON, GDAT, CySA+, CASP+, CISSP (or equivalent experience).
• Experience with Sentinel One, Zscaler ZIA, Google Sec Ops, Azure/M365 security tooling, e‑mail security and PAM.

• Detection & Response:
  Rapid triage, scoping and containment with minimal escalation.
• Analytical Rigor:
  Able to transform raw telemetry into actionable insights.
• Engineering Mindset:
  Build/tune detections, automate repetitive work and improve data quality.
• Risk Orientation:
  Prioritize actions based on business impact and threat likelihood.
• Documentation:
  Clear tickets, IR timelines and post‑incident reporting.

• Subject to both typical…