Security Operations Engineer

Alpaca is a US-headquartered self-clearing broker-dealer providing brokerage infrastructure and APIs to financial institutions across 40+ countries. The Security Operations Engineer will enhance day-to-day security operations by managing SOC relationships, operating SIEM systems, improving detection capabilities, and coordinating incident response. This role bridges IT and Security teams to ensure scalable, efficient, and proactive protection of financial systems and infrastructure.

Alpaca is seeking a Security Operations Engineer to strengthen and scale its security operations function. This role is responsible for detection engineering, SIEM management, incident response coordination, and operational security excellence. The engineer will work closely with IT, DevOps, Engineering, and an external SOC partner to ensure security alerts are actionable, incidents are handled effectively, and operational risks are mitigated.

Responsibilities:
- Manage the relationship with the third-party SOC, including SLAs and alert quality  
- Operate and tune the SIEM, including log ingestion, correlation rules, and alert optimization  
- Improve detection coverage across endpoints, identity, cloud, network, and applications  
- Assist in incident response, containment, eradication, and recovery efforts  
- Develop and maintain incident response playbooks and escalation workflows  
- Track and report on operational security metrics such as MTTD and MTTR  

Requirements:
- 3+ years of experience in Security Operations roles  
- Hands-on SIEM administration and alert tuning experience  
- Experience maintaining Kubernetes clusters and working with Linux  
- Scripting or automation skills using Python or Bash  
- Experience collaborating with third-party SOC or MSSP providers  
- Strong incident investigation and cross-functional communication skills  

Benefits:
- Competitive salary and stock options  
- Health benefits  
- $500 home-office setup stipend  
- $150 monthly stipend  

This role offers the opportunity to build scalable security operations within a globally distributed fintech environment.