Security Operations Engineer, 23andMe

• 4+ years in security operations, detection engineering, or incident response
• Detection-as-code experience, or a background in building response automation
• Demonstrated hands-on experience with threat detection, threat hunting, and incident investigation, including working directly with logs and telemetry to establish root cause
• Proficiency in at least one scripting language (Python preferred) and familiarity with common operating systems
• Experience acting as, or deputy to, the lead responder on at least one significant security incident
• Proficiency with EDR and SIEM platforms, and familiarity with a modern enterprise stack such as Okta, AWS, CrowdStrike or SentinelOne, Datadog, Sumo Logic, or Splunk
• Clear verbal and written communication, including the ability to stay composed under incident pressure and brief both technical and non-technical audiences
• Bachelor's degree in Computer Science, Information Systems, or a related field, or an equivalent combination of education and experience

Desirable

• 23andMe Research Institute is looking for an experienced Security Operations Engineer to join our Security Operations team. In this role you will lead security incident response as Incident Commander, triage and investigate alerts, and build the detection and automation architecture to help protect our customer and corporate data. You will bring critical thinking skills, hands-on experience, and the ability to work with and influence cross-functional teams
• Design, build, and tune threat detections, and measure and improve their fidelity over time
• Operate and extend our detections-as-code pipeline, from detection logic through testing and deployment, utilizing Terraform
• Triage, investigate, and prioritize security alerts across endpoint, identity, cloud, and application telemetry, separating true events from background noise
• Conduct proactive threat hunting informed by current attacker tradecraft
• Identify automation opportunities and build integrations that reduce manual response effort
• Serve as Incident Commander on a shared rotation, coordinating response across Engineering, IT, Legal, and Privacy for the duration of an incident
• Maintain and improve incident response runbooks and playbooks based on what you learn in real incidents
• Track open incidents through closure, confirm corrective and preventive actions, and report incident metrics to security leadership
• Partner with Engineering, IT, Research, and Compliance to build security automation, and measure whether it reduces detection and response time in practice
• Participate in an on-call rotation; eligible for an additional on-call bonus