Aurora
Staff Security Engineer, Cloud Detection & Response
$171K–$303K
Mountain View, CA +5 · Remote · Staff · Full-time · Posted Oct 21, 2026
- Location
- Mountain View, CA
Livonia, MI
San Francisco, CA
Pittsburgh, PA
Dallas, TX
Seattle, WA - Experience
- 10+ years of security experience.
About the job
Mature Aurora’s cloud and enterprise detection program by leading cross-functional initiatives and building detection infrastructure, coverage, and response capabilities.
What you'll do
- Lead projects to improve log ingestion and normalization, detection-as-code pipelines, and scalable telemetry collection.
- Design and tune detections, expand coverage, and conduct threat hunting across cloud, enterprise, identity, endpoint, and SaaS environments.
- Respond to security incidents, participate in on-call, and partner with engineering teams to improve logging, detection, containment, and remediation.
What they ask for
- 10+ years of security experience, including leading cross-functional security projects or programs from scoping through delivery.
- Expertise in cloud security, detection infrastructure, detection authoring, endpoint detection and response, and SaaS security monitoring or comparable telemetry.
- Strong foundation in threat detection and incident response; experience with incident management and cross-departmental containment and remediation.
- Expertise with MITRE ATT&CK and modern adversarial techniques; understanding of NIST CSF; ability to write quality, testable code in Python.
Nice to have
- Experience designing and implementing Zero Trust Architecture; scaling SOC or Detection Engineering with AI/LLM.
- Experience architecting data lakes or working with compliance frameworks (SOC 2, ISO 27001).
Pay
USD $189,000 - $303,000 per year (base salary; Mountain View); USD $171,000 - $273,000 per year (base salary; Pittsburgh, PA)
Tools
SIEM, Python, MITRE ATT&CK, NIST CSF, EDR, CI/CD, AI/LLM, SOC 2
AI focus
Experience scaling SOC or Detection Engineering with AI/LLM is desirable.
Model-written summary · the original posting is authoritative