[Hiring] Senior Security Engineer, Detection & Response @PrizePicks

Role Description

We're maturing Information Security's detection, incident response, and forensics capabilities, and we're looking for a seasoned SOC engineer to help lead that effort alongside the existing team. This is a hands-on role spanning monitoring, triage, response, and forensics, with real ownership over how the program evolves from here.

What you'll do:

• Own Detection & Monitoring: Own how we monitor and triage events and alerts ingested into the SIEM, working with the team to tune detection content, reduce false positives, and close coverage gaps.
• Build the Playbooks: Lead the design and continuous improvement of incident response playbooks, so response is consistent and repeatable across the team, even when you're not the one running it.
• Threat Hunt: Lead our threat hunting practice, proactively hunting for malicious or anomalous activity that alerting and automated detection don't catch.
• Mature Forensics Capability: Strengthen our digital forensics capability, including the processes and tooling that support investigations and evidence handling.
• Automate the Response: Drive automation for alerting, enrichment, and triage across the team's workflows to cut manual toil and reduce time to respond.
• Respond to Incidents: React to and lead response on incidents as they fire, coordinating across business partners as needed.
• Document and Learn: Document incidents, root cause, and remediation with clarity and rigor.
• Own Post-Incident Reviews: Build a structured, blameless post-incident review process, with real root-cause analysis, action items tracked to closure, and follow-through that goes beyond a debrief call.
• Mature the Program: Shape how the program measures itself and scales, evolving IR metrics, escalation paths, and priorities over time.

Qualifications

• Experience building or significantly maturing a SOC/IR function, as opposed to operating one that's already fully staffed.
• 5+ years in a SOC, incident response, or detection engineering role, with demonstrated ownership of an IR or monitoring program, outside of queue work.
• Strong grasp of the full incident response lifecycle: preparation, detection, containment, eradication, recovery, and lessons learned.
• Hands-on SIEM experience: log ingestion, correlation rules, detection tuning. Specific platform is flexible.
• Experience with forensic analysis and evidence handling across host and cloud environments.
• Comfort building automation/scripting for triage and response (Python or similar).
• Working knowledge of cloud environments (AWS/GCP/Azure) and common attacker TTPs (MITRE ATT&CK).
• Ability to define risk in both technical and business-relevant terms.
• Clear written communication: this role produces the playbooks and incident documentation the rest of the team relies on.

Requirements

• SIEM tooling: log correlation, alert tuning, content development (platform-agnostic).
• Digital forensics fundamentals: host, network, and/or cloud evidence collection and analysis.
• Scripting/automation ability (Python or similar) for triage and response workflows.
• Working knowledge of at least one major cloud provider (AWS, GCP, or Azure).
• Familiarity with MITRE ATT&CK and common threat actor TTPs.

Benefits

• Company-subsidized medical, dental, & vision plans
• 401(k) plan with company match
• Annual bonus
• Flexible PTO to encourage a healthy work/life balance (2 weeks STRONGLY encouraged!)
• Generous paid leave programs, including 16-week paid parental leave and disability benefits
• Workplace flexibility and modern work schedules focused on getting the job done, not hours clocked
• Company-wide in-person events and team outings
• Lifestyle enhancement program
• Company equipment provided (Windows & Mac options)
• Annual performance reviews with opportunities for growth and career development