Security Operations Engineer

Holistiplan offers award winning tax planning software specializing in tax planning, insurance risk management, and soon to be estate! We’re known for our industry leading tactical tax planning, reporting and scenario analysis solutions serving over 10,000 firms and 60,000 users. Holistiplan has been voted the #1 tax planning software in Kitces Report Studies and the #1 tax planning software for five consecutive years in the T3/Inside Information Software Surveys.

Holistiplan builds the financial planning platform trusted by Registered Investment Advisors (RIAs) to serve their clients — which means we handle sensitive tax documents, PII, and financial records ’re looking for a Security Engineer who can operate confidently across cloud infrastructure, detection engineering, and audit readiness to help us stay ahead of threats while maintaining our SOC 2 Type II posture.

This role is a strong fit for someone with solid hands‑on security experience who wants to keep building depth across cloud security, threat monitoring, incident response, vulnerability management, application security triage, and compliance support. You’ll work closely with the CISO, taking ownership of day‑to‑day security operations with increasing independence, while escalating high‑impact decisions appropriately.

What You’ll Do

Cloud Security (AWS)

• Monitor and assess AWS environments (IAM, VPC, S3, KMS, Cloud Trail, Guard Duty, Security Hub) and drive remediation of misconfigurations or exposed resources
• Review infrastructure changes for security implications; partner with engineering on secure architecture patterns
• Investigate configuration drift and IAM privilege escalation risks, escalating high‑impact findings to the CISO
• Support patch management across AWS infrastructure (EC2 OS‑level patching, AMI/golden image currency, AWS Systems Manager Patch Manager), with CISO/CTO sign‑off on production‑impacting changes

Detection & Monitoring (SIEM & EDR/XDR)

• Build, tune, and maintain detection rules and dashboards in Datadog Security Monitoring
• Triage security alerts, perform investigation, and elevate confirmed incidents per the IR playbooks
• Reduce alert fatigue through signal tuning, correlation logic, and false‑positive analysis
• Contribute to log source coverage gap analysis (mapped to MITRE ATT&CK where applicable)
• Monitor and respond to endpoint alerts via EDR/XDR tooling; investigate suspicious process activity and isolate compromised hosts, escalating for containment decisions
• Correlate signal across endpoint, identity, network, and cloud telemetry within the XDR platform to identify multi‑stage attacks that single‑source alerting would miss
• Help maintain EDR/XDR agent health/coverage across the fleet and tune detection policies to reduce false positives
• Support onboarding of new telemetry sources into the XDR platform and help evaluate detection coverage against the MITRE ATT&CK framework

AI‑Enabled Security Operations

• Use AI tools to accelerate detection, triage, response, and documentation
• Evaluate and pilot AI‑assisted security tooling, with appropriate data handling safeguards
• Help build internal playbooks/prompts that make the security team faster without compromising data governance
• Serve as a responder during security incidents: triage, containment, eradication, and recovery per the IR plan
• Perform initial forensic analysis on affected hosts, cloud resources, and accounts (log review, timeline reconstruction, scope determination)
• Support post‑incident activities: root cause analysis, lessons‑learned documentation, and tracking of remediation actions to closure
• Participate in tabletop exercises to validate IR readiness and identify playbook gaps
• Support breach assessment activities in partnership with the CISO; final…