Samsara
Senior Security Operations Engineer I
Remote - Vancouver +1 · Remote · Senior · Full-time · Posted Jun 24, 2026
- Location
- Remote - Vancouver
San Francisco - SF9 - Experience
- 5+ years in Security Incident Response; preferred: 3+ years in insider threat initiatives or employee investigations.
- Education
- Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field - or relevant industry experience.
- Visa sponsorship
- Offers are contingent on the ability to secure and maintain the legal right to work at the company and in the specified work location.
About the job
Monitors and responds to security events, leads incident response and digital forensic investigations, and improves security operations through guidance, runbooks, and automation.
What you'll do
- Monitor security events, analyze alerts, and lead incidents and employee investigations through closure, keeping stakeholders informed.
- Conduct digital forensic investigations and provide clear security guidance for incident response and insider threat initiatives.
- Build and improve security operations capabilities, integrations, runbooks, and automated workflows; mentor and train engineers.
What they ask for
- 5+ years of experience in Security Incident Response.
- Proficiency in Python and ability to build scripts or tools for investigations.
- Practical lead experience in security incident response, including alert triage and cross-team coordination; experience with SIEM log reviews.
- Understanding of forensic techniques on macOS, Windows, and Linux, and experience with cloud architecture and security (AWS, GCP).
Nice to have
- 3+ years of experience with insider threat initiatives or employee investigations; relevant degree or industry experience; GIAC Certified Incident Handler (GCIH).
- Familiarity with NIST Cybersecurity Framework, ISO 27001, or FedRAMP.
Pay
CAD 132,600–171,600 annual base salary
Tools
Python, macOS, Windows, Linux, SIEM, AWS, GCP, NIST Cybersecurity Framework
Model-written summary · the original posting is authoritative