Senior Security Operations Specialist, Relay

• 5+ years in security operations, incident response, or related cybersecurity roles
• Strong cloud security and identity security experience (AWS preferred)
• Comfortable making structured, high-impact decisions during active incidents
• Deep knowledge of common attack techniques, adversary TTPs (MITRE ATT&CK, etc.), and fraud/ATO patterns
• Strong written and verbal communication skills — able to explain complex technical issues to both technical and business audiences
• Ownership mindset with a bias toward action and continuous improvement
• Skilled in building detection logic and workflows for cloud-native environments and security tooling
• Experience with SOAR platforms and building/optimizing automated response playbooks
• Ability to communicate complex security issues clearly to both technical and business stakeholders
• You push relentlessly for reinvention: You’re built to constantly ask, “How can this be better?” Change excites you and you drive it
• You crave autonomy: We trust our team with big challenges and the freedom to solve them. If you’re someone who takes initiative, is comfortable taking risks, and seeks input when needed, you’ll find the freedom here empowering
• You own your work: You take pride in your work, follow through on commitments, and feel a deep sense of responsibility for outcomes, not just tasks
• You treat comfort as a red flag: You seek growth. When things feel too comfortable, you lean into change. You’re excited about stepping into the unknown and navigating new terrain to create something better alongside your team
• You care about impact, not noise: You care deeply about the substance of your work. You measure success by results, not recognition and you let your work speak for itself
• You’re energized by complexity and ambiguity: You enjoy tackling problems that don’t come with a playbook. You’re comfortable building from scratch, iterating as you go, and collaborating to shape the best path forward
• You seek out feedback: We value directness, clarity, and respect. We believe honesty fuels great work and career growth. You see feedback as a tool for learning and improvement, and you know that open, honest dialogue is key to achieving the best results — together
• You’re here for more than a job: At Relay, everything we do is in service of our mission to help small businesses thrive. To drive impact and have purpose here, that mission must matter to you too
• Research shows that women-identifying and other marginalized individuals often apply only if they meet 100% of the qualifications. But no one is a perfect match on paper. If this role excites you, we’d love to hear from you and figure out together if it’s a great fit

Desirable

• Relay is building a best-in-class, in-house Security Operations function to protect our customers, platform, and business as we scale. As a SecOps team member, you’ll be on the front line of detecting, investigating, and containing real security threats in real time, turning signals into action and incidents into lasting improvements
• Monitor, triage, and investigate high-severity security alerts across cloud infrastructure, identity, SaaS, endpoints, and production systems
• Validate threats versus noise and determine severity and impact
• Execute containment actions and coordinate response across teams
• Act as Incident Commander or deputy during security incidents
• Build and maintain investigation runbooks and response playbooks
• Work horizontally across Risk, AppSec, Engineering, Product, and business teams to ensure security findings lead to meaningful improvements in systems, practices, and outcomes
• Contribute to SOAR automation and alert enrichment
• Produce high-quality incident documentation and post-incident remediation
• Design and implement advanced threat detection logic using SIEM/XDR telemetry
• Perform threat hunting engagements to proactively detect stealthy adversaries
• Ensure security compliance and regulatory alignment: Partner with Compliance, Security, and Risk teams to implement and enforce security controls, standards, and policies across systems and services

• Stage 1: A 30-minute Google Meets video call with a member of the Talent Team
• Stage 2: A 45-minute Google Meets technical interview with the SecOps Manager
• Stage 3: A 45-minute meeting with a member of the leadership team
• Stage 4: A 60-minute case study presentation with members of the Security team and the SecOps Manager