Staff Security Engineer (Security Operations)

Join Pantheon, a leading webops platform, as a Senior Security Engineer in Security Operations. In this hands-on leadership role, you will design, implement, and run detection and response capabilities to keep our platform and customers safe. You will lead efforts in threat detection, incident response, and operational resilience, while driving automation and scalable processes to mature Pantheon’s security posture.

• Define, own, and execute a multi-year roadmap for Pantheon’s security operations capability, covering detection engineering, incident response, threat intelligence, exposure management, and abuse prevention.
• Lead the architecture of Pantheon’s SecOps toolchain (SIEM, SOAR, EDR/XDR, cloud security posture, identity monitoring), evaluate, select, and integrate security platforms.
• Drive the detection engineering programme — building a library of high-fidelity, low-noise detections mapped to MITRE ATT&CK, tuned across cloud, endpoint, and identity surfaces.
• Experience building or scaling a detection engineering programme from the ground up, including establishing detection coverage metrics and a continuous improvement cadence
• Experience managing security vendor relationships, running RFPs, and making build-vs-buy decisions for operational tooling
• Demonstrated experience leading major incident response — including managing stakeholders, running cross-functional war rooms, and driving post-incident improvement
• Strong hands-on background in cloud-native security across GCP and/or AWS — including logging pipelines, cloud security posture management, and IAM monitoring
• Hands-on with threat intelligence platforms (e.g., Recorded Future, Mandiant Advantage) and structured intelligence lifecycle management
• Preferred Experience
• Background in abuse monitoring, phishing detection, and takedown coordination with registrars, hosting providers, and law enforcement
• Holding one or more recognized security certifications: CISSP, CISM, GIAC (GCIA, GCED, GREM, GDAT), OSCP, or a cloud security specialty certification (GCP Professional Cloud Security Engineer, AWS Security Specialty)
• Track record of influencing technical direction beyond your immediate team — through design reviews, architecture documents, or cross-functional programme leadership
• Proficiency in scripting and automation (Python, Bash, or equivalent) applied to security engineering problems — not just tooling configuration
• Experience owning or materially contributing to EU regulatory compliance requirements (GDPR, NIS2) from an operational security perspective
• Deep expertise in architecting and operating enterprise-grade SIEM and SOAR platforms at scale (e.g., Chronicle, Splunk, Elastic SIEM, Palo Alto XSOAR, Tines)
• Expert-level knowledge of attack techniques and threat actor tradecraft (MITRE ATT&CK, MITRE D3FEND) and the ability to translate that into detection logic and response procedures
• Exposure to bug bounty programme operations and red team/purple team collaboration to validate detection coverage
• Excellent written and verbal communication skills with the ability to present technical risk clearly to both engineering audiences and executive leadership
• Prior experience working within the Irish or EU regulatory environment — familiarity with the Data Protection Commission (DPC), NIS2 obligations for essential/important entities, or ENISA guidance is a plus
• 10+ years of experience in information security, with 7+ years focused on security operations — spanning detection engineering, incident response, threat hunting, or SecOps programme leadership