Senior Security Operations Engineer

Who you are

• 5+ years in Cyber Security, with working knowledge of threat detection, incident response, or similar functions, and a BS in Computer Science, Information Security, or equivalent professional experience
• Experience designing enterprise-scale SOAR workflows and AI-driven security operations, with Python or Go skills to build integrations; enjoys writing scripts and tooling to automate operational tasks
• Experience collecting, normalising, and enriching logs from many sources into consistent schemas (e.g. OCSF), and managing data volume, retention, and cost so detections remain reliable and affordable at scale
• Hands-on Git and GitHub/GitLab skills, including managing detections and automation as code through peer review and CI/CD pipelines
• Familiarity with threats facing cloud-based apps and SaaS providers, adversary TTPs (MITRE ATT&CK), and how to spot them in activity logs
• Confidence leading large Security Incidents, coordinating responders across Security, Engineering, IT, and Support, and giving executive-style updates to stakeholders
• Excellent written and spoken English, with the ability to adapt your message for executive, technical, customer-facing, and non-technical audiences

What the job involves

• Join Personio’s Security organization to build detection and response that scales with the business. Own detections as code, build SOAR automations and the data pipelines behind them, use AI to make triage and response faster, and secure the AI agents and integrations the company adopts
• Design, deploy, and maintain high-quality detections on the SIEM platform, managed through Git with peer review and CI/CD
• Build enterprise-scale SOAR workflows and the integrations behind them, using AI where it makes triage and response faster
• Tune noisy or underperforming alerts, and measure whether AI-assisted triage is accurate enough to trust
• Secure AI agents and integrations (e.g. MCP) with least-privilege access, and guard against prompt injection and data exposure
• Act as the Security Team’s on-duty representative, answering inquiries from across the business and responding to urgent matters
• Lead and support Security Incidents and Post Mortems, coordinate responders across Security, Engineering, IT, and Support, and drive follow-up improvements
• Proactively hunt for signs of compromise, and keep detection and response playbooks current with new insights and automations

Benefits

• Receive a competitive reward package – reevaluated each year – that includes salary, benefits, and pre-IPO equity
• Enjoy 28 days of paid vacation, plus an additional day after 2 and 4 years (because we love what we do, but we also love vacation!)
• Make an impact on the environment and society with Impact Days
• Receive generous family leave, child support, mental health support, and sabbatical opportunities with PersonioCares
• Connect with your fellow Personios at regular company and team events like All Company Culture Week and local year-end celebrations
• Engage in a high-impact working environment with flat hierarchies and short decision-making processes
• Find your best way to work with our office-led, and remote-friendly PersonioFlex!