[Hiring] Staff Security Engineer @Pantheon Systems, Inc

Role Description

As a Staff Security Engineer, SecOps, you are the technical anchor of Pantheon's security operations function, and above all, the person we trust to command our hardest incidents. When something serious happens, you set the tempo: scoping, severity, containment strategy, stakeholder communication, and the post-incident work that makes us stronger every time.

This is a staff-level role, which means your impact extends well beyond your own queue. You define the incident response methodology the whole team runs on, you turn every incident and hunt into better detections in partnership with Security Engineering, and you set the direction for what our automation should do next.

We are an AI-forward security team: our SOAR capability already exists inside Google SecOps, and we are building ARES, our AI-assisted incident response platform. We are not hiring you to program SOAR playbooks. We're hiring you to bring the incident judgment that tells ARES what to automate, and the AI fluency to prototype it yourself with tools like Claude.

The engineers who thrive here come from engineering-shaped backgrounds, people who script, automate, read code, and learn new systems on their feet, and pair that with deep, tested incident response craft.

What You'll Do

• Command major incidents.
• Own incident response methodology.
• Drive the hunting → detection feedback loop.
• Direct AI-assisted automation (ARES).
• Govern the SIEM platform.
• Level up the team.
• Communicate up.
• Support the broader programme.

Qualifications

• 8+ years in information security with substantial time in security operations, including demonstrated command of major incidents.
• Deep incident response methodology knowledge (NIST 800-61 / SANS PICERL or equivalent).
• Threat hunting and detection craft: expert working knowledge of attacker tradecraft (MITRE ATT&CK).
• AI fluency: you use AI assistants and LLM tooling in your daily workflow today.
• An engineering mindset: comfortable with Python/Bash scripting, APIs, and cloud-native environments (GCP and/or AWS).
• CISSP (or equivalent depth — CISM, GCIH/GCIA/GDAT-class GIAC).
• Hands-on experience operating an enterprise SIEM (Google SecOps/Chronicle strongly preferred).
• Excellent written and verbal communication.

Requirements

• Ability to walk through your incident command methodology (scoping, severity, containment, communication, post-incident review).
• Track record of building or materially improving an IR programme: playbooks, severity frameworks, escalation paths, PIR discipline.
• Proven ability to convert hunts and incidents into detection logic and response procedures.
• Excited to apply AI tools to investigation and response.
• Ability to prototype, automate, and hold your own in engineering design discussions.
• Experience at governance level — coverage, log strategy, quality.

Benefits

• Industry competitive compensation and equity plan.
• Robust vacation package with 28 days of holiday.
• Private medical and dental coverage.
• Life and critical illness insurance.
• Attractive workplace pension scheme.
• Access to Employee Resource Platform.
• Top-of-line equipment.
• Monthly allowance for wellness, reading, and access to LinkedIn Learning for continued development.
• Events and activities, both team-based and company-wide, that inspire, educate, and cultivate.