Senior Security Operations Engineer

Fleetio is hiring a Senior Security Operations Engineer on its Business Technology team to engineer and operate corporate security across detection and response, identity, endpoints, email, SaaS, data loss prevention, AI, and vulnerability management. The role builds connected security controls and automation, leads incident response, and partners with IT Operations, Compliance, an external SOC, and Product Security.

Responsibilities:

• Own detection engineering and threat hunting in CrowdStrike Next-Gen SIEM: onboard log sources, write and tune detections across identity, email, SaaS, and endpoint telemetry, and keep false positives down
• Own security automation: chain our tools together through CrowdStrike Fusion SOAR and our workflow automation platform so a signal in one (a risky Okta sign-in, a Falcon detection, a Mimecast hit, a Google Workspace sharing change) triggers enrichment, containment, paging, and ticketing in the others, plus AI agents that speed up triage and investigation, so routine response runs without waiting on a human
• Lead corporate incident response as technical lead, including third-party and supply-chain events: scope exposure quickly, confirm or rule out compromise, run forensics, tell leaders and employees what to do, keep runbooks current with Product Security, and serve in the escalation rotation, backing up the Incident Commander when needed
• Own CrowdStrike Falcon configuration and detections, manage the Falcon Complete relationship and escalations, and maintain device trust checks and an inventory of software and extensions on company devices with clear guidance on approved tools
• Own Okta authentication policy, MFA, session policy, and privileged access management, and automate user access reviews and audit evidence with Compliance so SOC 2 controls run with less manual effort
• Own Mimecast policy, secure network access, Google Workspace and key SaaS security settings, and SaaS security posture in CrowdStrike Falcon Shield, driving findings to closure with app owners
• Own data loss prevention: define and classify Fleetio's sensitive data, design and tune DLP policies across email (Mimecast), Google Workspace, endpoints (CrowdStrike), and key SaaS apps, and investigate and respond to data exposure, whether from accidental oversharing, a compromised account, or insider misuse
• Own security for Fleetio's use of AI: visibility into AI tool usage, identity and access for AI agents, guardrails for internal agents and automations, and AI detection and response (CrowdStrike Falcon Guardian, formerly AIDR)
• Run vulnerability management for corporate assets, prioritizing by exploitability and holding owners to fix deadlines, and report on security posture with clear, honest metrics that help set program priorities

Requirements:

• 5+ years of experience in security operations, detection and response, or security engineering, ideally at a SaaS company
• Detection engineering and threat hunting in a SIEM (CrowdStrike Next-Gen SIEM or similar)
• Security automation: building SOAR playbooks (CrowdStrike Fusion or similar) that connect identity, endpoint, email, and SaaS tools into a single response flow, with Python or PowerShell and REST APIs
• Incident response from first triage through forensics, root cause, and follow-up across cloud, identity, and SaaS environments, including working with an MDR or managed SOC provider
• Identity security with Okta or a similar provider: authentication policy, privileged access, and access reviews in a SOC 2 or ISO 27001 control environment
• Endpoint security with CrowdStrike or similar, including macOS, plus device trust and endpoint query tooling
• Email security (Mimecast or similar) and SaaS security posture management
• Designing and running a DLP program: data classification, policy design and tuning across email, cloud collaboration, and endpoints, and investigating data exposure
• Securing developer tooling and the software supply chain (IDE extensions, package registries, AI coding tools)
• Excellent written and verbal communication skills, including explaining risk to non-technical leaders
• Experience securing a company's use of AI: AI tool governance, identity and access for agents, data-exposure and prompt-injection risk, and AI detection and response tooling (CrowdStrike Falcon Guardian/AIDR or similar)
• Experience building AI agents, LLM-powered automations, or integrations (e.g., using tool/function calling or MCP) for security operations workflows
• Experience using LLMs on real security alerts for triage, enrichment, and investigation