Security Monitoring Infrastructure Engineer

Must Have Technical/Functional Skills:

• Working knowledge of Linux system administration across multiple Linux distributions (e.g., Debian and RedHat derivatives) and several architectures.
• Proficiency in shell scripting (Bash) and Python for automation and tooling.
• Experience with distribution package creation and support (RPM, DEB).
• Familiarity with CI/CD pipelines, particularly GitHub-based workflows (GitHub Actions, GitHub CI/CD).
• Comfort using version control systems (Git) and collaborative development practices.
• Willingness to operate carefully in an environment where changes affect large-scale infrastructure.
• A strong sense of responsibility, ownership, and attention to detail.

Roles & Responsibilities

• Sustaining & Operations: Help maintain, monitor, and troubleshoot deployed security monitoring agents (e.g., osquery) across a large and varied fleet of Linux systems.
• Framework Support: Assist in maintaining and improving the framework that supports these agents, including CI/CD pipelines (GitHub Actions or equivalent), automated testing, and release processes.
• Ongoing Operational Support: Provide dependable day-to-day operational support to help ensure availability, performance, and stability of the monitoring infrastructure.
• Packaging & Distribution: Build, maintain, and support distribution packages (e.g., .deb, .rpm) across multiple Linux distributions.
• Automation & Scripting: Write and maintain shell scripts and Python tooling to automate deployment, configuration, monitoring, and remediation tasks.
• Reliability & Change Management: Follow careful change management practices, keeping in mind that actions in this role can have wide-reaching impact across the company's systems.
• Collaboration: Work alongside CSIRT analysts, infrastructure teams, and other stakeholders to support monitoring coverage and continuous improvement.

Preferred Qualifications

• Exposure to osquery or similar endpoint security/telemetry agents.
• Some background in security operations or SOC/CSIRT environments.
• Experience supporting Linux systems at scale.
• Practical knowledge of at least one major cloud service provider platform (by decreasing order of preference: AWS, Azure, GCP)
• Awareness of containerization and orchestration (Docker, Kubernetes).
• Basic understanding of monitoring/observability platforms and log pipelines.

What Defines Success in This Role

• Reliable, stable operation of security monitoring agents across the fleet.
• Well-tested, dependable contributions to the supporting framework and pipelines.
• Proactively flagging and helping resolve operational issues.
• A consistent record of safe, careful changes in a large-scale environment.
• Adaptability to the ever-changing landscape of security tools/techniques

Salary Range: $94,000 - $120,000 a year