ai analyst backend bitcoin blockchain community manager crypto cryptography cto customer support dao data science defi design developer relations devops discord economy designer entry level erc erc 20 evm front end full stack gaming ganache golang hardhat intern java javascript layer 2 marketing mobile moderator nft node non tech open source openzeppelin pay in crypto product manager project manager react refi research ruby rust sales smart contract solana solidity truffle web3 py web3js zero knowledge
| Job Position | Company | Posted | Location | Salary | Tags |
|---|---|---|---|---|---|
Ondo Finance | United States | $94k - $150k | |||
Jito Labs | United States | $180k - $200k | |||
Exo Tech | New York, NY, United States | $100k - $200k | |||
CoinDesk | New York, NY, United States | $125k - $145k | |||
| Learn job-ready web3 skills on your schedule with 1-on-1 support & get a job, or your money back. | | by Metana Bootcamp Info | |||
HAZZA Network | United States | $105k - $150k | |||
Bank of America | Charlotte, NC, United States | $86k - $90k | |||
The Greene Group | New York, NY, United States | $150k - $250k | |||
Partnerverse | United States | $39k - $75k | |||
Rain | New York, NY, United States | $50k - $999k | |||
Autheo | United States | $77k - $115k | |||
Ondo Finance | United States | $140k - $240k | |||
Perena | United States | $81k - $107k | |||
Rain | New York, NY, United States | $180k - $250k | |||
Rain | New York, NY, United States | $90k - $133k | |||
Longbridge | Dallas, TX, United States | $124k - $158k |
Security Engineer - Operations / Incident Response
Remote (US)
Security
Remote
Full-time
About Ondo
Ondo Finance is building institutional-grade financial infrastructure for tokenized real-world assets. We operate at the intersection of traditional finance and on-chain systems.
About the Role
We are hiring a Senior Security Engineer — Operations / Incident Response to own the day-to-day defense of Ondo. You will be a technical lead for our SIEM, EDR, email security, and SOAR stack. This is a hands-on role: you will write detections, tune them, run incidents, build automations, and decide what tooling we keep, replace, or retire.
You will partner closely with IT, Infrastructure, Product Security, and our Security Incident Response Team (SIRT) to mature how Ondo detects and responds to threats across SaaS, endpoints, cloud, and identity.
What You’ll Do
- Detection engineering lifecycle in our SIEM (e.g., Splunk, Panther, or equivalent) — write detections, tune for noise, version them in code, and measure their performance.
- EDR (e.g., CrowdStrike, SentinelOne) deployment, policy tuning, exclusions hygiene, and response playbooks across macOS-heavy and Linux fleets.
- Email security stack: tune detections, investigate phish, run takedowns, and drive user reporting workflows.
- Build and operate SOAR / response automation to take repetitive analyst work to zero.
- Particpate in and lead incident response: triage, contain, eradicate, recover, and write the post-mortem. Run tabletop exercises with engineering and exec stakeholders.
- Build and maintain the on-call rotation, runbooks, and severity definitions for the SIRT.
- Integrate identity telemetry and SaaS audit logs into detection coverage; close the gap between IT signals and security signals.
- Partner with Infrastructure Security on cloud detection coverage and with Product Security on application-layer signals.
- Build, deploy, and operate AI-native workflows in our SecOps stack — LLM-assisted triage, alert summarization, evidence collection, draft IR comms, and analyst copilots — with the guardrails to keep them safe and auditable.
- Define how we monitor *internal* AI usage (sanctioned LLMs, MCP servers, browser-based agents) and how we detect AI-driven attacks against our employees and customers (deepfake voice/video, AI phishing, prompt injection in shared tooling).
- Help us decide where AI belongs in critical workflows (incident comms drafting, log search, detection tuning) and where it does not (signing actions, irreversible response, anything touching customer funds).
What We’re Looking For
- 3-5+ years in security operations, detection engineering, or incident response, including time as a senior IC at a fast-moving company.
- Deep, hands-on experience with at least one SIEM (Splunk, Panther, Elastic, Sentinel, Chronicle)
- Production experience with EDR tuning and IR (CrowdStrike, SentinelOne, Defender, or equivalent).
- Solid working knowledge of email security tooling and modern phishing TTPs (BEC, OAuth consent phishing, vendor impersonation, callback phishing).
- SOAR / automation experience
- Strong scripting skills (Python preferred); comfortable working in Git and treating detections as code.
- Operational maturity: you can lead an incident, write a clean post-mortem, and push organizational changes that come out of it.
- Working fluency with cloud security telemetry in at least one of AWS, GCP, or Azure.
- Practical experience integrating AI/LLMs into security workflows, *or* a track record of evaluating new tooling rigorously and shipping it into production.
Nice to Have
- Background defending crypto, fintech, or other high-value-target environments.
- Experience with on-chain monitoring tools and blockchain-aware incident response.
- Threat hunting against identity-based attacks (OAuth abuse, session token theft, IdP compromise).
- Public detection-engineering, IR, or research output (blogs, talks, open-source).
Ready to apply?
Powered by
First name *
Last name *
Email *
LinkedIn URL
Resume *
Click to upload or drag and drop here
Are you currently authorized to work in the United States without the need for employer sponsorship?
Will you now or in the future require sponsorship for employment visa status in the United States?
Req ID: R74