Staff Security Engineer Detection & Response

Your goal to improve the education process and better the lives of students by keeping their data secure.

What you will do:

- Triage and investigate alerts from our SIEM/UEBA, endpoint detection and response, cloud, and email security platforms to determine whether indicators of compromise represent a real intrusion
- Declare, lead, and manage security incidents end to end endpoint compromise, cloud and infrastructure compromise, credential theft, phishing, and insider risk — through containment, eradication, and recovery
- Own written incident documentation, including timelines, root cause analysis, and post-incident reviews that drive durable fixes rather than one-off cleanup
- Build, tune, and maintain detection content to expand coverage of real attacker behavior while reducing false positives and alert fatigue
- Develop and maintain incident response playbooks and runbooks
- Between incidents, contribute to security engineering work: deploying and operating security tooling in our cloud setting, closing logging and telemetry gaps, and automating response actions
- Partner with IT, engineering, and cloud platform teams to drive remediation of identified weaknesses to closure

What you’ll bring

- 7+ years of relevant work experience, with significant time spent in security operations, detection and response, or incident response
- Hands-on experience investigating alerts across SIEM/UEBA and endpoint detection and response tooling, and separating true positives from noise at volume
- Demonstrated experience leading incident response from detection through recovery, including coordinating responders and stakeholders across teams




- Strong understanding of attacker tradecraft and common attack paths across endpoint, identity, network, and cloud, and familiarity with a framework such as MITRE ATT&CK;
- Working knowledge of security in cloud environments, ideally AWS, including identity, logging, and the misconfigurations attackers most often abuse
- Experience writing and tuning detection logic, correlation rules, or queries against large log data sets
- Scripting and automation ability, such as Python, and comfort working with open-source tools and APIs to connect systems and remove manual effort
- Practical familiarity with Windows, macOS, and Linux internals, and the forensic artifacts each produces during an investigation
- Sound judgment and composure under pressure, including the ability to make decisions with incomplete information
- Excellent written and oral communication skills, including the ability to explain an incident clearly to both engineers and executives
- Ability to work independently and with various other teams across the organization
- Creative, resourceful, and adaptive problem solving

Stand Out Qualifications

- Experience with a SIEM or UEBA platform such as Exabeam, and an endpoint detection and response platform such as SentinelOne
- Experience working in AWS with features such as GuardDuty, CloudTrail, Security Hub, Inspector, IAM, WAF and Shield
- Experience managing detection content as code, under version control and peer review
- Familiarity with SOAR platforms and automated response workflows
- Digital forensics, malware analysis, or reverse engineering experience
- Experience working with container technologies including Docker and Kubernetes
- Relevant certifications such as GCIH, GCIA, GCFA, OSCP, or AWS Certified Security – Specialty

📌 Staff Security Engineer - Detection & Response (Delhi)
🏢 Chegg
📍 Delhi