Security Operations Engineer

Alpaca is a US-headquartered financial services infrastructure company offering brokerage APIs and trading platforms. This Security Operations Engineer role owns the daily operation and continuous improvement of Alpaca's SIEM and SOAR capabilities, including log onboarding, detection engineering, alert tuning, and response automation.

• Onboard new security log sources across cloud, identity, endpoint, SaaS, and application systems with parsing, normalization, and data quality checks
• Build, test, and tune detection rules based on threat intelligence and incident learnings, mapped to frameworks such as MITRE ATT&CK
• Design and maintain SOAR playbooks that automate response actions including enrichment, containment, ticketing, and notifications
• Triage, investigate, and respond to security alerts across endpoints, identity, cloud, network, and application logs
• Support security incidents with evidence collection, detection queries, and containment actions; develop and improve runbooks and escalation paths
• Run hypothesis-driven threat hunts and turn findings into new detections
• Participate in the Security Operations on-call rotation

• 3+ years of experience in Security Operations or detection engineering roles
• Hands-on experience operating and tuning a SIEM
• Experience building SOAR playbooks or equivalent response automation
• Working knowledge of Linux
• Scripting or automation experience in Python or Bash for security operations tasks
• Experience onboarding and parsing log sources from cloud, identity, and SaaS platforms
• Strong alert investigation skills across identity, endpoint, network, and cloud environments
• Understanding of common attacker techniques and detection methodologies
• Experience supporting security incidents, including evidence collection, detection queries, and containment
• Strong written and verbal communication skills, especially during incidents

• Experience securing financial, trading, or other highly regulated platforms
• Familiarity with compliance frameworks such as SOC 2 or ISO 27001
• Experience with detection-as-code, Git Ops, and CI/CD pipelines
• Knowledge of cloud security logging on AWS, GCP, or Azure and SaaS security telemetry
• Familiarity with Kubernetes-hosted security tooling
• Security certifications such as GCIA, GCIH, or GCED
• Ability to balance security rigor with operational efficiency and business needs

Competitive Salary & Stock Options, Health Benefits, New Hire Home-Office Setup:
One-time USD $500, Monthly Stipend: USD $150/month via Brex Card