Senior Security Operations Engineer

About the role

CoreWeave is The Essential Cloud for AI™. Built for pioneers by pioneers, CoreWeave delivers a platform of technology, tools, and teams that enables innovators to build and scale AI with confidence. Trusted by leading AI labs, startups, and global enterprises, CoreWeave combines superior infrastructure performance with deep technical expertise to accelerate breakthroughs and turn compute into capability. Founded in 2017, CoreWeave became a publicly traded company (Nasdaq: CRWV) in March 2025. Learn more at www.coreweave.com.

About the Role

As a Senior Security Operations Engineer I, you will independently lead the investigation and response to complex security events and incidents. You will serve as an escalation point for other analysts, contribute to the development of detections and automation, and help improve the processes and tooling that support our growing security operations program.

In this role, you will:

- Participate in a 24/7/365 SOC, including rotating on-call coverage for overnights and weekends.

- Independently investigate and respond to complex security events across Linux, macOS, cloud, and Kubernetes environments.

- Determine the scope, impact, severity, and appropriate escalation path for potential security incidents.

- Coordinate containment and remediation activities with security, engineering, infrastructure, and operations teams.

- Utilize and query SIEM, EDR, and other security tools to identify suspicious activity and develop actionable findings.

- Create and improve detections-as-code, investigation procedures, automation, runbooks, and response workflows.

- Perform post-incident reviews and recommend improvements to security controls and response capabilities.

- Partner with threat intelligence and detection engineering teams to prepare for emerging threats and address gaps in coverage.

- Serve as an escalation point and mentor for junior engineers, providing guidance during investigations and reviewing their work.

- Lead scoped operational and technical improvement projects that increase the effectiveness and scalability of the SOC.

Who You Are

- 3–5+ years of experience in security operations, incident response, digital forensics, detection engineering, or a related field.

- Strong experience investigating and responding to security events with limited or incomplete information.

- Strong working knowledge of Linux and macOS systems, including system internals, logging, and common forensic artifacts.

- Experience investigating Kubernetes or container security events.

- Proficiency with modern security tools and platforms, including SIEM, EDR, IDS/IPS, and firewalls.

- Strong understanding of network protocols, VPNs, proxies, identity systems, and other security technologies.

- Experience developing or tuning security detections, preferably using detections-as-code.