Senior Security Engineer

• SIEM Engineering & Administration: Own the SIEM platform end to end, including log source onboarding, correlation rule development, detection tuning, dashboarding, and platform performance and cost management.
• Incident Response: Lead the full incident response lifecycle, including triage, containment, eradication, recovery, root cause analysis, and post-incident reporting.
• Threat Detection & Hunting: Build and maintain detection content mapped to MITRE ATT&CK; conduct proactive threat hunts across cloud infrastructure, endpoints, identity systems, and network traffic.
• Security Operations: Define and enforce SOC processes, including alert triage workflows, escalation paths, on-call procedures, and operational metrics such as mean time to detect and mean time to respond.
• Log Source Architecture: Manage ingestion pipelines from cloud audit logs (e.g., AWS CloudTrail), EDR, identity providers, network security platforms, and endpoint management tools into the SIEM.
• Threat Intelligence Integration: Operationalize threat intelligence feeds into detection rules, enrichment workflows, and hunting hypotheses.
• Automation & Scripting: Develop automation for detection engineering, alert enrichment, and response playbooks to reduce manual analyst workload and speed response time.
• Tabletop Exercises: Lead in and support tabletop exercises to assess and continuously improve incident response procedures, crisis management, and disaster recovery plans.
• Cross-Functional Investigations: Correlate findings across infrastructure, application security, and identity teams during investigations, and drive permanent remediation of identified risks.
• Reporting: Produce technical incident reports and SOC posture reporting that give leadership clear visibility into detection coverage, response performance, and outstanding risk.
• Standards & Documentation: Define and enforce detection engineering standards, runbooks, and playbooks used across the security team. 

• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent work experience required.
• Cyber-specific certification required (e.g., GCIH, GCFA, CISSP, or a relevant SIEM/vendor certification).
• Minimum of seven (7) years of IT experience, with at least four (4) years in a security engineering, SOC, or incident response role.
• Expert-level, hands-on experience with SIEM platforms (Sumo Logic strongly preferred), including log architecture, correlation rule development, and performance tuning.
• Working knowledge of incident response methodology (e.g., NIST 800-61) and fluency with the MITRE ATT&CK framework.
• Strong understanding of AWS security logging and detection services (CloudTrail, GuardDuty, Security Hub) and Windows/Linux log sources; Linux required.
• Hands-on experience investigating alerts and telemetry from EDR (e.g., CrowdStrike), network security platforms (e.g., Zscaler), and O365/identity log sources.
• Advanced scripting and automation experience with PowerShell, Python, or Bash required.
• Ability to work fully independently and lead multiple complex investigations and projects to completion.
• Excellent interpersonal and communication skills (verbal and written) across all levels of the organization.
• Strong analytical and problem-solving skills, with sound judgment under incident pressure.
• Ability to deliver on objectives.

• Experience participating in tabletop exercises preferred.
• Healthcare industry experience preferred.

Based on relevant market data and other factors, the anticipated hiring range for this role is $120,000 to $150,000 annually. Final compensation rates will be determined based on various factors, including but not limited to experience, skills, knowledge, and internal equity considerations. This role is also short-term incentive eligible. Incentive amounts will vary by individual and business goals. 

We are committed to fair and equitable compensation practices. The final salary offered to the selected candidate may vary from the posted range due to individual qualifications. Our goal is to ensure that all teammates are compensated fairly and competitively based on their contributions to our organization.

RxBenefits is also committed to providing best in class benefits to our teammates. We offer a robust total rewards package that includes:

• Remote first work environment
• Choice of a HDHP or PPO Medical plan, we pay 100% of the premium for the HDHP for you and your eligible family members
• Dental, Vision, Short- and Long-Term Disability, and Group Life Insurance that we also pay 100% of premiums (for your family too on Dental and Vision)
• Additional buy-up options for Short- and Long-Term Disability and Life Insurance
• 401(k) with an employer match up to 3.5% available after 60 days
• Community Service Day to give back and support what you love in your community
• 10 company holidays including MLK Day, Juneteenth, and the day after Thanksgiving plus a floating holiday to use as you like
• Reimbursements for high-speed internet, we’ll send you a computer and monitors to help you do your best work
• Tuition Reimbursement for accredited degree programs
• Paid New Parent Leave that can be used for adoption or birth
• Pet insurance to protect your furbabies
• A robust mental health benefit and EAP service through Spring Health to support you when you need it most