From the listing
About the role
At Beyond Finance, we've made it our mission to help everyday Americans escape the endless cycle of crippling debt and step into a brighter financial future. Through compassionate, individualized care, a culture focused on compliance and ethics, supportive user-centric technology, and customized financial solutions, we've helped over 1 million clients.
You'll build the detections and automation that protect our cloud, SaaS applications, and user workstations. You'll be the team's Datadog expert, owning how security telemetry gets into Datadog Cloud SIEM, how it's filtered, and the detections that run on it. As we bring automation and AI into security operations, you'll help build and ship the new capabilities.
What you'll do
- Write, tune, and retire Cloud SIEM detections, and map coverage to MITRE ATT&CK to close gaps.
- Onboard sources and build Datadog log pipelines that parse, normalize, and enrich security telemetry.
- Manage detections in version control with testing and peer review.
- Build workflows for alert enrichment, triage, containment, and notification.
- Build AI-assisted triage and alert summarization, with a human in the loop.
- Track coverage, false-positive rate, and automation rate to decide what to fix next.
- Manage indexes, exclusion filters, and retention tiers to cut noise and cost without losing coverage.
- Support triage, investigations, and incident response, including on-call.
What they're looking for
- 3+ years in security operations, detection engineering, or security engineering.
- You write your own scripts and build detection logic as code.
- Deep hands-on Datadog experience, especially Cloud SIEM detection rules and log pipelines.
- Experience with automation orchestration tooling.
- Working knowledge of MITRE ATT&CK.
- Experience with security telemetry from cloud platforms, SaaS applications, and EDR.
- You can take a project from prototype to production with little direction.
Nice to have
- Infrastructure as code and CI/CD experience.
- Threat hunting or purple teaming experience.
- Measures success by real threats caught and noise removed, not by the number of detections written.
- Automating a problem is their first move; would rather ship a working detection this week and tune it than wait for a perfect rule.
- Tests every parsing and detection change against real logs.
- Uses AI to move faster but verifies its output.
- Fixes coverage gaps or noisy log sources instead of filing a ticket.
Benefits, as listed
2 of these also appear in the perks Jeff verified on the company page.
The hot takeJeff's read on Beyond Finance
Jeff hasn't written this one up yet.
Ask, and Beyond Finance jumps the queue.