Defensive Operator

Role Overview

The Defensive Operator (DO) is a core member of our Security Operations team, responsible for handling case investigations and contributing to the continuous improvement of our defensive capabilities. You’ll work independently on investigations, identify opportunities to optimize our detection and response workflows, and escalate to Senior Defensive Operators when needed.

What You’ll Do

• Handle case investigations: Rapidly triage, investigate, and resolve security cases across multiple, distinct client architectures. You will operate under strict SLAs, requiring quick decision-making and thorough documentation to drive incidents through to completion.
• Identify SOAR optimization opportunities: Spot repetitive tasks and manual processes that could benefit from automation. Work with the team to implement workflow improvements.
• Identify detection rule tuning opportunities: Flag false positives, coverage gaps, and noisy rules. Contribute to improving signal quality across our detection stack.
• Participate in on-call rotation: Join the team’s on-call schedule to respond to after-hours incidents.
• Execute High-Impact Escalations: Recognize when incidents require senior expertise. Clearly and concisely package the blast radius, threat context, and recommended containment steps for rapid handoff to SDOs.

Required Qualifications

• Experience: 2-4 years in security operations, incident response, or a MDR/MSSP environment.
• Investigation skills: Ability to triage alerts, conduct thorough investigations, and draw sound conclusions from available data.
• Tool experience: Hands-on experience with SIEM platforms, EDR solutions, and security tooling (Elastic, LimaCharlie, MDE, etc.). Comfortable writing queries and navigating telemetry.
• Scripting ability: Working knowledge of Python, PowerShell, or Bash for analysis and automation tasks.
• Communication: Clear written documentation. Ability to explain findings and provide context when escalating.
• Process mindset: An aggressive eye for identifying operational inefficiencies and proactively suggesting engineering improvements.

Preferred Qualifications

• Experience with cloud security monitoring (AWS, GCP, Azure)
• Familiarity with SOAR platforms (Tines, Phantom, XSOAR, etc.)
• Understanding of MITRE ATT&CK framework
• Relevant certifications (GCIA, GCIH, CySA+, Security+, or similar)
• Familiarity with the LimaCharlie SecOps Cloud Platform
• Experience with Infrastructure-as-Code for detection rule management

Location & Schedule

• Remote with flexible hours aligned around core operating hours of Mountain Time or Eastern Time
• Day-shift primary hours with flexible start/end times
• On-call rotation participation for after-hours incidents and weekends.

How We Hire

• 30-minute intro call
• 45-minute technical conversation (investigation scenarios, tool experience)
• Practical exercise reviewing a realistic case
• Team chat
• Offer

We’re an equal-opportunity employer. If you meet most of the requirements, we’d love to hear from you.

Pay: $60,000.00 - $100,000.00 per year

Benefits:

• 401(k)
• Dental insurance
• Health insurance
• Life insurance
• Paid training
• Retirement plan
• Vision insurance

Work Location: Remote