Drimva

Samsara

Senior Security Operations Engineer

$135K–$228K

San Francisco, CA, United States +1 · Senior · Full-time · Posted Sep 15, 2026

Location
San Francisco, CA, United States
San Francisco - SF9
Experience
5+ years in Security Incident Response; preferred: 3+ years in insider threat initiatives or employee investigations.
Education
Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field, or relevant industry experience (preferred).

About the job

Leads security incident response and digital forensic investigations, while improving security operations through guidance, runbooks, tools, and automated workflows.

What you'll do

  • Monitor and analyze security events, lead incidents through closure, and keep stakeholders informed.
  • Conduct digital forensic investigations and employee investigations; provide security guidance for incident response and insider threat initiatives.
  • Coordinate security operations capabilities and integrations, and improve processes, runbooks, and automation.

What they ask for

  • 5+ years of experience in Security Incident Response and practical experience leading incident response.
  • Proficiency in Python and ability to build scripts or tools for investigations.
  • Understanding of forensic analysis on macOS, Windows, and Linux, and experience with SIEM log reviews.
  • Experience with cloud architecture and security, including AWS or GCP; must reside in the Pacific Time Zone of the United States or Canada and participate in on-call rotation.

Nice to have

  • 3+ years working on insider threat initiatives or employee investigations.
  • GIAC Certified Incident Handler (GCIH), familiarity with NIST Cybersecurity Framework, ISO 27001, or FedRAMP; degree in Computer Science, Information Security, or related field, or relevant industry experience.

Pay

$135,481 — $227,700 USD (annual base salary)

Tools

Python, macOS, Windows, Linux, SIEM, AWS, GCP, NIST Cybersecurity Framework

Model-written summary · the original posting is authoritative

First seen Oct 10, 2026 · Last verified Nov 5, 2026 (UTC)