Junior Security Operations Engineer

About the Role

We’re looking for a Junior Security Operations Engineer who is AI-Forward to help scale and modernize our SecOps program. This is a hands-on, builder role for someone who will design and ship the security tooling that powers our triage, investigations, and response workflows.

You’ll report to the Technical Operations Director and work alongside our GRC lead to improve our vulnerability intake, threat response, darkweb posture, and internal security tooling. A core part of this role is building AI-assisted security tooling: triage agents that pre-classify bug bounty reports, investigation copilots that pull context from logs and SIEM data, response workflows that draft remediation steps and track them to closure. You’ll spend as much time wiring up that tooling as you will reproducing vulnerabilities and working incidents.

This role suits someone who thrives in a lean, high-impact environment, has strong opinions on where humans add value versus where tooling should take over, and wants to shape how a modern security team operates.

What You’ll Do

Triage & Vulnerability Management

• Review incoming vulnerability reports from our bug bounty intake; reproduce and document valid issues for engineering teams.
• Build the tooling that improves signal-to-noise: automate duplicate detection, spam filtering, and abuse flagging so humans only touch what’s worth touching.
• Act on DAST findings: coordinate remediation, verify fixes, and re-test.
• Track remediation timelines for critical vulnerabilities and keep stakeholders honest on SLAs.

Threat Response & Monitoring

• Monitor and respond to EDR and cloud security alerts; investigate, contain, and document.
• Analyze darkweb findings and credential exposures; shape our darkweb monitoring practices and tooling over time.
• Improve detection coverage: tune noisy rules, close gaps, and enrich alerts with context so responders spend time on decisions, not data gathering.
• Help configure and tune DLP, SIEM, and AI security tooling.

Security Tooling (core to this role)

• Build AI-assisted triage tooling that pre-classifies bug bounty reports, flags duplicates, and routes real issues to the right engineering team with reproduction context attached.
• Build investigation tooling: LLM-backed copilots and Slack bots that pull alert context, correlate signals across sources, and surface what actually matters.
• Build response tooling: workflows that draft remediation steps, generate evidence artifacts, and track issues to closure across the teams that own them.
• Evaluate emerging AI security tooling and bring what’s genuinely useful into the stack; retire what isn’t.
• Apply a security-minded lens to our own AI usage: prompt injection, data exfiltration, model misuse, and the guardrails that go around them.

Compliance & Cross-Functional

• Support audit evidence collection for SOC 2, ISO 27001, and PCI DSS.
• Partner with ITOps to verify patches, endpoint coverage, and access hygiene.

You May Be a Good Fit If You Have

• Previous experience in a SecOps, Security Analyst, or Threat Response role.
• Proven ability to understand and reproduce technical vulnerabilities. You can read a bug report and tell whether it’s real.
• Experience with bug bounty triage (HackerOne, Bugcrowd, or similar).
• Hands-on exposure to SIEM, EDR, and DLP tools in production environments.
• A genuine, demonstrated interest in applying AI/LLMs to security work: side projects, internal tooling, prompt engineering, agent frameworks, anything that shows you’ve actually built with this stuff.
• Scripting and automation skills in Python, Bash, or similar. You reach for code before you reach for a checklist.
• Comfort working autonomously across time zones and asynchronously.
• Strong written communication. You can turn a messy investigation into a clear, defensible writeup.

Bonus Points For

• Experience building LLM agents, RAG pipelines, or Slack bots backed by OpenAI / Anthropic / open-source models.
• Detection engineering experience (Sigma rules, custom Falcon queries, Grafana/Loki dashboards).
• Cloud security depth in AWS or GCP (IAM, workload posture, cloud-native logging).
• Prior work in regulated environments (SOC 2, ISO 27001, PCI DSS) from the practitioner side.
• Exposure to AI/ML security concerns such as prompt injection, model evals, and data leakage through LLMs.
• Public contributions: blog posts, CVEs, open-source tools, CTF writeups.

Engagement & Logistics

• Full-time contract.
• Remote-first and async-friendly. We have hubs in San Francisco, Denver, Dublin, and Amsterdam. If you’re near one, we’d love to see you in the office regularly; if you’re elsewhere in the world, that works too.
• Potential to extend or convert based on fit.
• Reports to the Technical Operations Director; works closely with the GRC lead and IT Operations.

How We Work

We’re a lean, high-trust team. We value people who ship, who can operate independently, and who treat security as an engineering problem rather than a checklist. If you’re someone who sees a repetitive task and immediately thinks “this should be a script, or better yet, an agent,” you’ll fit in here.

To Apply

Tell us about a time you used AI, automation, or custom tooling to meaningfully change how a security workflow ran. What was manual before, what it looked like after, and what you learned. Links to code, writeups, or demos are welcome.