01Overview
At Anaplan, we are a team of innovators focused on optimizing business decision-making through our leading AI-infused scenario planning and analysis platform so our customers can outpace their competition and the market.
What unites Anaplanners across teams and geographies is our collective commitment to our customers success and to our Winning Culture.
Our customers rank among the whos who in the Fortune 50. Coca-Cola, LinkedIn, Adobe, LVMH and Bayer are just a few of the 2,400+ global companies who rely on our best-in-class platform.
Our Winning Culture is the engine that drives our teams of innovators. We champion diversity of thought and ideas, we behave like leaders regardless of title, we are committed to achieving ambitious goals, and we love celebrating our wins big and small.
Supported by operating principles of being strategy-led, values-based and disciplined in execution, youll be inspired, connected, developed and rewarded here. Everything that makes you unique is welcome; join us and lets build whats next - together!
What youll be doing: As a Senior Security Engineer in the Security Operations team, you will design, build, and enhance our technical capabilities for detecting, investigating, and responding to threats. You will bridge engineering and operations, transforming security challenges into scalable, automated solutions. Your key responsibilities include:
- SIEM Engineering: Lead the engineering of our SIEM platform, onboard and normalize log sources, build and maintain parsers, and ensure high-fidelity data pipelines for detection and investigation. Continuously improve log coverage, data quality, and platform performance.
- Detection Engineering: Create and maintain a library of high-quality detections using a Detection as Code approach, managing detection content through version control, peer review, and automated testing. Map detections to the MITRE ATT&CK; framework and enhance coverage, precision, and resilience against evasion.
- SOAR & Automation: Develop and maintain automated workflows and playbooks using SOAR platforms to streamline alert triage, enrichment, and response. Identify and automate manual processes to enable scalable operations.
- AI-Augmented Security Operations: Explore and implement AI and machine learning to enhance security operations, including alert triage, incident response, threat intelligence analysis, threat hunting, and detection content enrichment. Evaluate and responsibly integrate emerging AI tools into workflows.
- Threat Intelligence Integration: Operationalize threat intelligence from various sources, integrating indicators and adversary context into detection logic, SOAR playbooks, and hunting activities. Ensure actionable intelligence is timely and structured for security operations.
- Threat Hunting: Conduct proactive, hypothesis-driven threat hunts to identify attacker activity that evades existing detections. Document findings and use them to improve detection engineering and tooling.
- Incident Response Support: Provide engineering-level support during security incidents, aiding in investigation, containment, and recovery. Contribute to post-incident reviews and apply lessons learned to enhance detections, playbooks, and tooling.
What youll bring to the role: We seek a technically adept security professional with hands-on experience in building and operating security capabilities in complex environments. The ideal candidate will have:
- Technical Security Experience: Extensive experience in security engineering, DevSecOps, or a similar role, with a solid background in securing cloud-native environments and modern application stacks.
- Detection & Response Skills: Practical experience in developing and tuning SIEM detections, writing threat hunting queries, and participating in incident response.
- SecOps Tooling: Proficiency in administering and operating core security operations tools, including SIEM platforms (e.g., Splunk, Microsoft Sentinel), EDR/XDR solutions, vulnerability scanners, and ticketing systems. Experience integrating these tools for detection, investigation, and response workflows.
- Threat Intelligence & Threat Hunting: Experience with threat intelligence platforms and feeds (e.g., MISP, Recorded Future, VirusTotal), and integrating intelligence into security tooling and operational processes. Familiarity with threat hunting methodologies and the ability to identify indicators of compromise or attacker behavior is highly desirable.
- Scripting & Automation: Proficiency in scripting or programming languages (e.g., Python, Go, Bash) to build security tools, automate workflows, and integrate security capabilities.
- Application Security Knowledge: Understanding of secure development practices, OWASP top risks, and the ability to perform code reviews or collaborate with developers to address security findings.
- Security Frameworks & Standards: Familiarity with relevant security frameworks (e.g., NIST CSF .
