Job Description
About the Role
We are seeking a hands-on Security Engineer to support our Threat Intelligence team in scaling and optimizing a high-volume takedown program. This role is focused on execution, automation, and data-driven decision-making, not strategy alone.
You will work directly with a growing pipeline of security signals and takedown requests, helping reduce false positives, identify malicious activity, and improve the efficiency and durability of the overall workflow.
This is a fast-paced, high-impact opportunity for someone who can quickly ramp up and contribute in a short timeframe.
What You’ll Do
- Manage and triage high-volume takedown requests, distinguishing between malicious activity, legitimate partners, and false positives
- Use SQL to analyze large datasets, identify trends, and uncover patterns in adversary behavior
- Collaborate with internal teams and external vendors to coordinate and execute takedowns
- Build and enhance automation (Python, APIs, AI tools) to improve classification, routing, and processing efficiency
- Continuously improve workflows to reduce backlog and increase signal quality
- Apply practical security judgment to assess indicators and make fast, accurate decisions
Required Qualifications
- Strong SQL proficiency (non-negotiable) – ability to write queries independently and analyze data effectively
- Background in security operations (SOC, Incident Response, Threat Intelligence, or Security Engineering)
- Experience working with high-volume alerts, signals, or security data
- Familiarity with DevOps concepts, APIs, and automation workflows
- Strong problem-solving skills and ability to operate in ambiguous, fast-moving environments
- Must be located in San Diego, CA and able to work onsite 3 days/week
Preferred Qualifications
- Experience with takedown operations, adversary disruption, or vendor coordination
- Proficiency in Python scripting for automation
- Experience using AI or prompt engineering to improve workflows and efficiency
- Familiarity with cloud environments (AWS, GCP)
- Exposure to internet infrastructure, abuse patterns, or fraud detection
What Success Looks Like
- Rapid ramp-up with minimal guidance
- Reduction in takedown backlog and improved processing efficiency
- Increased accuracy in distinguishing malicious vs. benign signals
- Implementation of automation that reduces manual workload
- Meaningful contribution within a short contract window