[Hiring] Cloud Security Operations Engineer @Gainsight

Role Description

We’re looking for a full-time Cloud Security Operations Engineer to join our Security team reporting to the Senior Manager, AI Response & Threat. This role is a remote role based in Mexico.

In this role, you’ll play a key role in strengthening our cloud detection and response practice by:

• Defending multi-cloud environments
• Building cloud detection coverage
• Leading incident investigations
• Developing tooling and processes that make the team more effective

This is a great opportunity for someone who thrives in a complex enterprise environment and enjoys working cross-functionally with teams like engineering and technical and non-technical stakeholders. The ideal candidate brings strong skills in cloud security operations, incident response, and SIEM detection engineering.

What You'll Do

• Triage and investigate alerts end-to-end across cloud-native tooling (GuardDuty, Sentinel, Security Command Center), determining severity and scope and closing with documented findings
• Detect and respond to cloud-specific threats, including identity compromise, privilege escalation, access key and token abuse, misconfiguration exploitation, and data exfiltration from cloud storage
• Build detections on cloud audit logs (CloudTrail, Azure Activity and Entra ID logs, GCP Cloud Audit Logs), network flow logs, and container and workload telemetry
• Run proactive threat hunts using ATT&CK-aligned methods, including the Cloud and Containers matrices, to surface attacker activity that automated detection has missed
• Build automation for cloud containment actions, such as credential revocation, instance isolation, and policy quarantine
• Lead incident response from scoping and containment through post-incident review, performing forensics across cloud, host, network, and memory, and reporting clearly to technical and non-technical stakeholders
• Build, tune, and maintain SIEM correlation rules and Sigma-based detection-as-code pipelines that reduce noise and improve signal quality
• Own the health and reliability of the SecOps tooling estate, including SIEM, EDR, SOAR, and log ingestion pipelines, with responsibility for coverage, integration uptime, and vendor escalation
• Participate in the on-call rotation, maintain operational runbooks, and contribute to red and purple team exercises
• This role may require occasional travel (up to 10-20%) for team meetings, training, or company events.

Qualifications

• 4+ years in security engineering, SOC operations (T2/T3), or incident response within a complex enterprise environment, including 3+ years defending production cloud workloads
• Bachelors Degree (or equivalent experience) and/or 5 years of related experience
• Strong knowledge of cloud security architecture and telemetry in at least one major provider (AWS, Azure, or GCP), including the log sources needed for effective detection and investigation
• Deep understanding of cloud IAM and identity-based attack paths, such as role assumption abuse, federation weaknesses, and long-lived credential compromise
• Hands-on experience investigating real cloud incidents using native cloud logs and forensic acquisition methods
• Experience with cloud-native threat detection services and with ingesting and normalizing cloud logs in a SIEM
• Working knowledge of core cloud infrastructure (compute, storage, networking, and serverless) sufficient to assess risk and advise on remediation
• Advanced proficiency with an enterprise SIEM, including detection authoring, correlation rules, pipeline administration, and tuning to reduce false positives at scale
• Working command of MITRE ATT&CK to map detections to technique coverage, identify telemetry gaps, and design hunts against specific adversary behaviors
• Digital forensics experience across host, network, and memory artifacts, including memory acquisition, disk imaging, and multi-source timeline correlation
• Scripting in Python, PowerShell, or Bash, with production automation, log enrichment, or tooling integrations to show for it

Requirements

• CSPM/CNAPP or cloud workload protection experience (Wiz, Prisma Cloud, Defender for Cloud, Orca)
• Experience in multi-cloud environments
• Container and Kubernetes security (EKS, AKS, GKE), including runtime threat detection and image scanning
• IaC for cloud guardrails and security configuration (Terraform, CloudFormation)
• SOAR experience (XSOAR, Splunk SOAR, Torq), including playbook development, API integrations, and case management
• Detection-as-code workflows with CI/CD integration and automated rule validation
• Relevant Professional Certifications: GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer

Benefits

• Innovation shaped through collaboration, curiosity, and a shared focus on solving real-world problems
• Growth opportunities, including mentoring and career development
• A supportive culture that values stability and trust