安全工程师
Security Engineer
加入我们，为客户提供愉悦的体验。Five9 是一家领先的云客服中心软件提供商，将云创新的力量带给全球客户。
我们每天践行价值观，打造以团队为先的文化，使我们能够一起创新、成长和繁荣。我们重视多样性，营造包容的环境，赋能员工做真实的自己。
我们的优先级流程高度依赖人工智能，因此分析师很少直接处理警报。该职位的工作围绕优先级展开：事件响应、检测工程、响应自动化、威胁情报，以及构建优先级流程所依赖的人工智能工具。该职位更接近安全工程角色，而非传统的 SOC 分析师角色，我们期望你编写代码。该职位需要在太平洋时间工作（上午 9:00 至下午 5:00）。
**职责**
- **事件响应。** 全程负责事件：界定范围、遏制、取证、撰写报告并跟进修复。
- **检测工程。** 编写、调整、测试和淘汰检测规则。检测内容受版本控制，经过评审，并根据结果而非警报数量进行评估。
- **响应自动化。** 构建操作手册、集成和工作流，从响应流程中移除重复的手动步骤。这是该职位的重要部分。
- **威胁情报。** 跟踪与我们环境相关的活动，并将其转化为检测、狩猎和加固工作。
- **威胁狩猎。** 参与基于假设的威胁狩猎计划。
- **AI 辅助开发。** 构建和改进优先级流程背后的代理、提示和增强逻辑。
- **警报优先级。** 有限：流程提出的升级警报，以及用于改进流程的反馈。
**要求**
- 具备实际的安全运营经验，包括可以详细说明的事件。
- 精通至少一种脚本语言（Python 或等效语言），并倾向于用代码解决重复性问题。
- 熟悉检测逻辑、日志管道和现代遥测来源：EDR、身份、云、网络和 SaaS。
- 能够处理模糊的问题，定义完成的标准并加以实现。
- 清晰的书面沟通能力：事件时间线、设计笔记和事后分析。
**优先考虑**
- 具有 GCP 和/或 AWS 经验，包括云日志、IAM 和云特定的故障模式。
- 低代码自动化
查看英文原文
Join us in bringing joy to customer experience. Five9 is a leading provider of cloud contact center software, bringing the power of cloud innovation to customers worldwide.
Living our values everyday results in our team-first culture and enables us to innovate, grow, and thrive while enjoying the journey together. We celebrate diversity and foster an inclusive environment, empowering our employees to be their authentic selves.
Our triage pipeline is heavily AI-enriched, so analysts spend little of their day working alerts directly. The role is the work around triage: incident response, detection engineering, response automation, threat intelligence, and building the AI tooling the pipeline runs on. It is closer to a security engineering role than to a conventional SOC analyst role, and we expect you to write code. This position requires the person to work Pacific Time hours (9:00AM - 5:00PM).
**Responsibilities**
- **Incident response.** Own incidents end to end: scoping, containment, forensics, write-up, and remediation follow-through.
- **Detection engineering.** Write, tune, test, and retire detections. Detection content is version controlled, reviewed, and measured on outcomes rather than alert volume.
- **IR automation.** Build playbooks, integrations, and workflows that remove repeated manual steps from the response process. This is a large part of the role.
- **Threat intelligence.** Track activity relevant to our environment and convert it into detections, hunts, and hardening work.
- **Threat hunting.** Be a contributor to our hypothesis-led threat hunting initiatives.
- **AI-assisted development.** Build and improve the agents, prompts, and enrichment logic behind the triage pipeline.
- **Alert triage.** A limited amount: escalations the pipeline surfaces, plus the feedback that improves it.
**Requirements**
- Hands-on security operations experience, including incidents you can walk through in detail.
- Proficiency in at least one scripting language (Python or equivalent) and a preference for solving recurring problems with code.
- Working knowledge of detection logic, log pipelines, and modern telemetry sources: EDR, identity, cloud, network, and SaaS.
- Ability to take an ambiguous problem, define what done looks like, build it.
- Clear written communication: incident timelines, design notes, and postmortems.
**Preferred**
- GCP and/or AWS experience, including cloud logging, IAM, and cloud-specific failure modes.
- Low-code automation platforms such as Tines or n8n, and judgment about when a workflow should become production code.
- Agent programming and prompt engineering, specifically LLM tooling reliable enough for operational use.
- Experience with AI-enriched detection or triage pipelines.
**How the team works**
You will be given problems rather than tickets, and you are responsible for the solution and the reasoning behind it. There is no micromanagement and minimal handholding. This suits people who self-direct and are candid when something is not working. It does not suit people who need an assigned queue.
Work Location: This role is fully remote for candidates who reside outside the 30 mile radius of one of our offices. For candidates who reside within a 30 mile radius of one of our offices, this role is Hybrid and would require 3 days a week (T, W, TH) in office.
* * *
As part of our continued commitment to diversity, equity, and inclusion, Five9 supports pay transparency during the entire recruitment process. Actual compensation packages are based on several factors that are unique to each candidate including, but not limited to: skill set, depth of experience, certifications, and specific work location. The range displayed reflects the minimum and maximum target for new hire salaries for the job across the United States. Your recruiter can share more about the specific compensation package during your hiring process.
Additionally, the total compensation package for this position may also include an annual performance bonus, stock, and/or other applicable incentive compensation plans.
Our total reward package also includes:
- Health, dental, and vision coverage, beginning on the first day of employment. Five9 covers 100% of the employee portion of the health, dental and vision coverage and shares a high portion of the dependent cost. We also offer Short & Long-Term Disability, Basic Life Insurance, and a 401k saving plan with employer matching.
- Access to an innovative mental health support platform that offers personalized care and resources in areas such as: therapy, coaching and self-guided mindfulness exercises for all covered employees and their covered dependents.
- Generous employee stock purchase plan.
- Paid Time Off, Company paid holidays, paid volunteer hours and 12 weeks paid parental leave.
All compensation and benefits are subject to the requirements and restrictions set forth in the applicable plan documents and any written agreements between the parties.
The US base salary range for this role is below.
$66,300—$174,700 USD
Five9 embraces diversity and is committed to building a team that represents a variety of backgrounds, perspectives, and skills. The more inclusive we are, the better we are. Five9 is an equal opportunity employer.
* * *
View our privacy policy, including our privacy notice to California residents here: [https://www.five9.com/pt-pt/legal](https://www.five9.com/pt-pt/legal).
Note: Five9 will never request that an applicant send money as a prerequisite for commencing employment with Five9.