Senior Security Engineer II – Threat Detection & Response

Sigma Computing Sigma Computing · Data AI · New York, NY · Security / GRC / IT

Senior Security Engineer focused on threat detection, response, and building proactive security controls within a cloud-native SaaS environment. The role involves writing production-grade code for detections, automating remediation, and leading incident management, with a strong emphasis on threat intelligence and adversary TTPs.

What you'd actually do

  1. Develop and maintain a comprehensive adversary response strategy, mapping organizational risks to specific threat actor TTPs (Tactics, Techniques, and Procedures).
  2. Act as a Subject Matter Expert to Infrastructure, Engineering, and security teams. Guide these partners in implementing proactive security controls, ensuring that security is "baked in" to the development lifecycle and corporate infrastructure.
  3. Lead and build collaborative threat modeling sessions for new products and infrastructure, helping cloud platform, Engineering and IT identify and neutralize architectural weaknesses before deployment.
  4. Build, tune, and constantly update a library of high-fidelity detections. You will ensure our alerting logic evolves in lockstep with new exploitation techniques and industry benchmarks.
  5. Architect SOAR workflows to ensure common adversary techniques are met with immediate, automated remediation, reducing the manual burden on IT and Ops.

Skills

Required

  • 7+ years in security
  • 5+ years focused on detection engineering, incident response, or threat hunting
  • Cloud-native environments experience
  • Fast-paced SaaS environments experience
  • AWS/GCP/Azure security
  • Modern Identity Stack
  • Kubernetes security
  • Terraform/IaC
  • Coding for automation, security pipeline, detection as code
  • Cloud IAM attack paths
  • Token/session abuse
  • API threats
  • Data exfiltration patterns
  • CI/CD for detections
  • Telemetry pipelines design and operation
  • High-severity incident response leadership
  • Threat intelligence frameworks (MITRE ATT&CK)
  • Incident response tests, breach and attack simulations (BAS), or red/blue team exercises
  • Security tooling (SIEM, EDR, CNAPP, WAF, CASB, Data Security)
  • Translate complex technical threats to guidance

Nice to have

  • GCIA
  • GCIH
  • GCTI
  • CISSP
  • CCSP
  • Contributions to open-source security projects
  • Published research

What the JD emphasized

  • production-grade code
  • scalable detections
  • automate response
  • proactive threat controls
  • deep knowledge of cloud, identity, application, and data attack paths
  • moving organizations from reactive IR to threat-informed defense
  • Strong coding ability
  • Deep understanding of cloud IAM attack paths, token/session abuse, API threats, and data exfiltration patterns
  • Deep expertise in security tooling