gainsight - Cloud Security Operations Engineer
Requirements
• 4+ years in security engineering, SOC operations (T2/T3), or incident response within a complex enterprise environment, including 3+ years defending production cloud workloads • Bachelors Degree (or equivalent experience) and/or 5 years of related experience • Strong knowledge of cloud security architecture and telemetry in at least one major provider (AWS, Azure, or GCP), including the log sources needed for effective detection and investigation • Deep understanding of cloud IAM and identity-based attack paths, such as role assumption abuse, federation weaknesses, and long-lived credential compromise • Hands-on experience investigating real cloud incidents using native cloud logs and forensic acquisition methods • Experience with cloud-native threat detection services and with ingesting and normalizing cloud logs in a SIEM • Working knowledge of core cloud infrastructure (compute, storage, networking, and serverless) sufficient to assess risk and advise on remediation • Advanced proficiency with an enterprise SIEM, including detection authoring, correlation rules, pipeline administration, and tuning to reduce false positives at scale • Working command of MITRE ATT&CK to map detections to technique coverage, identify telemetry gaps, and design hunts against specific adversary behaviors • Digital forensics experience across host, network, and memory artifacts, including memory acquisition, disk imaging, and multi-source timeline correlation • Scripting in Python, PowerShell, or Bash, with production automation, log enrichment, or tooling integrations to show for it • CSPM/CNAPP or cloud workload protection experience (Wiz, Prisma Cloud, Defender for Cloud, Orca) • Experience in multi-cloud environments • Container and Kubernetes security (EKS, AKS, GKE), including runtime threat detection and image scanning • IaC for cloud guardrails and security configuration (Terraform, CloudFormation) • SOAR experience (XSOAR, Splunk SOAR, Torq), including playbook development, API integrations, and case management • Detection-as-code workflows with CI/CD integration and automated rule validation • Relevant Professional Certifications: GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer
Responsibilities
• Triage and investigate alerts end-to-end across cloud-native tooling (GuardDuty, Sentinel, Security Command Center), determining severity and scope and closing with documented findings • Detect and respond to cloud-specific threats, including identity compromise, privilege escalation, access key and token abuse, misconfiguration exploitation, and data exfiltration from cloud storage • Build detections on cloud audit logs (CloudTrail, Azure Activity and Entra ID logs, GCP Cloud Audit Logs), network flow logs, and container and workload telemetry • Run proactive threat hunts using ATT&CK-aligned methods, including the Cloud and Containers matrices, to surface attacker activity that automated detection has missed • Build automation for cloud containment actions, such as credential revocation, instance isolation, and policy quarantine • Lead incident response from scoping and containment through post-incident review, performing forensics across cloud, host, network, and memory, and reporting clearly to technical and non-technical stakeholders • Build, tune, and maintain SIEM correlation rules and Sigma-based detection-as-code pipelines that reduce noise and improve signal quality • Own the health and reliability of the SecOps tooling estate, including SIEM, EDR, SOAR, and log ingestion pipelines, with responsibility for coverage, integration uptime, and vendor escalation • Participate in the on-call rotation, maintain operational runbooks, and contribute to red and purple team exercises
Benefits
• Gainsight is a place where innovation is shaped through collaboration, curiosity, and a shared focus on solving real-world problems. With a growing suite of products across customer success, product experience, community, education, and AI-powered relationship intelligence, we continue to evolve with the needs of our customers. When people with diverse strengths, a strong sense of community, and true passion for our mission come together, they drive greater impact and create lasting value. What underpins it all is a culture that offers the stability, trust, and support that people need - not just to do the job, but to show up as themselves and feel connected to the work they do. Gainsters love working here for several reasons. Here are a few: • Our Core Values: We are guided by our values and our mission to be living proof you can win in business while being Human-First. Learn more here https://www.gainsight.com/company/. • Our Growth Opportunities: From mentoring to career development opportunities, we’re passionate about helping our teammates learn, grow, and thrive. • Our Parody Videos: No explanation needed. Just watch them here! https://www.youtube.com/playlist?list=PLB2Z_xLbXPiAcvQr28ggP2CndoSu29zq_ • If this sounds like the right role for you, we’d love to hear from you. • Additional Information:
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT