Cloud Security Operations Engineer

We’re looking for a full-time Cloud Security Operations Engineer to join our Security team reporting to the Senior Manager, AI Response & Threat. This role is a remote role based in Mexico.

In this role, you’ll play a key role in strengthening our cloud detection and response practice by defending multi-cloud environments, building cloud detection coverage, leading incident investigations, and developing the tooling and processes that make the team more effective. This is a great opportunity for someone who thrives in a complex enterprise environment and enjoys working cross-functionally with teams like engineering and technical and non-technical stakeholders. The ideal candidate brings strong skills in cloud security operations, incident response, and SIEM detection engineering.

• Triage and investigate alerts end-to-end across cloud-native tooling (GuardDuty, Sentinel, Security Command Center), determining severity and scope and closing with documented findings
• Detect and respond to cloud-specific threats, including identity compromise, privilege escalation, access key and token abuse, misconfiguration exploitation, and data exfiltration from cloud storage
• Build detections on cloud audit logs (CloudTrail, Azure Activity and Entra ID logs, GCP Cloud Audit Logs), network flow logs, and container and workload telemetry
• Run proactive threat hunts using ATT&CK-aligned methods, including the Cloud and Containers matrices, to surface attacker activity that automated detection has missed
• Build automation for cloud containment actions, such as credential revocation, instance isolation, and policy quarantine
• Lead incident response from scoping and containment through post-incident review, performing forensics across cloud, host, network, and memory, and reporting clearly to technical and non-technical stakeholders
• Build, tune, and maintain SIEM correlation rules and Sigma-based detection-as-code pipelines that reduce noise and improve signal quality
• Own the health and reliability of the SecOps tooling estate, including SIEM, EDR, SOAR, and log ingestion pipelines, with responsibility for coverage, integration uptime, and vendor escalation
• Participate in the on-call rotation, maintain operational runbooks, and contribute to red and purple team exercises

…