Gainsight Cloud Security Operations Engineer at Gainsight responsible for defending multi-cloud environments and leading incident investigations. Develop tooling and processes to enhance cloud detection and response capabilities.
Responsibilities
We’re looking for a full-time Cloud Security Operations Engineer to join our Security team reporting to the Senior Manager, AI Response & Threat. This role is a remote role based in Mexico.
Triage and investigate alerts end-to-end across cloud-native tooling (GuardDuty, Sentinel, Security Command Center), determining severity and scope and closing with documented findings
Detect and respond to cloud-specific threats, including identity compromise, privilege escalation, access key and token abuse, misconfiguration exploitation, and data exfiltration from cloud storage
Build detections on cloud audit logs (CloudTrail, Azure Activity and Entra ID logs, GCP Cloud Audit Logs), network flow logs, and container and workload telemetry
Run proactive threat hunts using ATT&CK-aligned methods, including the Cloud and Containers matrices, to surface attacker activity that automated detection has missed
Build automation for cloud containment actions, such as credential revocation, instance isolation, and policy quarantine
Lead incident response from scoping and containment through post-incident review, performing forensics across cloud, host, network, and memory, and reporting clearly to technical and non-technical stakeholders
Build, tune, and maintain SIEM correlation rules and Sigma-based detection-as-code pipelines that reduce noise and improve signal quality
Own the health and reliability of the SecOps tooling estate, including SIEM, EDR, SOAR, and log ingestion pipelines, with responsibility for coverage, integration uptime, and vendor escalation
Participate in the on-call rotation, maintain operational runbooks, and contribute to red and purple team exercises
This role may require occasional travel (up to 10-20%) for team meetings, training, or company events. This is not a complete list of responsibilities, and the scope of the role may evolve with the needs of the team and business.
Qualification
4+ years in security engineeringScripting in PythonNice-to-have skills or experience
Required
4+ years in security engineering, SOC operations (T2/T3), or incident response within a complex enterprise environment, including 3+ years defending production cloud workloads
Bachelors Degree (or equivalent experience) and/or 5 years of related experience
Strong knowledge of cloud security architecture and telemetry in at least one major provider (AWS, Azure, or GCP), including the log sources needed for effective detection and investigation
Deep understanding of cloud IAM and identity-based attack paths, such as role assumption abuse, federation weaknesses, and long-lived credential compromise
Hands-on experience investigating real cloud incidents using native cloud logs and forensic acquisition methods
Experience with cloud-native threat detection services and with ingesting and normalizing cloud logs in a SIEM
Working knowledge of core cloud infrastructure (compute, storage, networking, and serverless) sufficient to assess risk and advise on remediation
Advanced proficiency with an enterprise SIEM, including detection authoring, correlation rules, pipeline administration, and tuning to reduce false positives at scale
Working command of MITRE ATT&CK to map detections to technique coverage, identify telemetry gaps, and design hunts against specific adversary behaviors
Digital forensics experience across host, network, and memory artifacts, including memory acquisition, disk imaging, and multi-source timeline correlation
Scripting in Python, PowerShell, or Bash, with production automation, log enrichment, or tooling integrations to show for it
