Customer Success Engineer (CSE)

<div>
<div>
<div>
<div>
<div>
<div> </div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<p>Daylight delivers Managed Agentic Security Services (MASS), MDR, threat hunting, and a security data lake, through a fundamentally different architecture than traditional security providers.</p>
<p>Our agentic platform runs the full cycle from detection to response, informed by security experts from IR and threat hunting backgrounds. The platform learns your environment and investigates alerts; experts validate decisions, optimize detections, and take over during incidents.</p>
<p>The result: security teams move from firefighting to strategic work.</p>
<p>We're looking for a <strong>Customer Success Engineer</strong> to own the technical relationship with a portfolio of customer security teams, from onboarding through steady-state operation. You'll be the go-to technical partner for our customers' security engineers, answering most questions on the spot and serving as first-line response across shared channels. This is not a ticket-routing role: every Daylight account is a live integration project. You'll work alongside a Customer Success Manager who owns the commercial relationship, while you own the technical one.</p>
<p><strong>Responsibilities</strong></p>
<ul>
<li>Execute onboarding: run the integration checklist against contracted scope, set up escalation paths and on-demand paging, and drive accounts to silent-mode exit with status visible to the customer</li>
<li>Run stale and non-stale activation tracks separately, keeping onboarding moving without CSM follow-up</li>
<li>Serve as live first-line technical response in shared Slack or Teams channels and the Pylon queue</li>
<li>Confirm integrations are live, sending data, and that the response policy is active; catch expiring tokens, lapsed permissions, and unannounced new tooling</li>
<li>Run working sessions with customer security engineers on escalation and response policies, test notification rules end to end, and wire case data into their ticketing until analysts adopt it</li>
<li>Tune detections, false escalations, and the end-to-end case experience</li>
<li>Explain case dispositions clearly enough to expand response scope from investigations to quarantine and isolation</li>
<li>Maintain Pylon knowledge base articles, service differentiator docs, escalation policies, and troubleshooting playbooks</li>
<li>File field observations in Linear so Product and the SOC see what you see</li>
<li>Deliver QBR technical content to the CSM ahead of the deck</li>
<li>Escalate cleanly to the Solutions Architect pool when needed, with the investigation already done</li>
<li>Travel roughly quarterly for customer visits, company events, or conferences</li>
</ul>
<p><strong>Requirements</strong></p>
<ul>
<li>4+ years in a customer-facing technical role such as CSE, TAM, Solutions Engineer or Architect, or Implementation Engineer</li>
<li>Background in cybersecurity, ideally with experience in security operations, detection and response, MDR, or SIEM/EDR tooling</li>
<li>Startup or high-growth experience where process is still being built</li>
<li>Ability to hold a technical conversation with a customer's security engineer independently</li>
<li>Hands-on scripting experience</li>
<li>Working knowledge of APIs, SaaS integrations, log pipelines, and modern cloud architecture</li>
<li>Ability to read logs, trace a workflow, isolate root causes, and communicate findings clearly</li>
<li>Strong prioritization and written communication skills across multiple accounts</li>
<li>Experience with structured onboarding and building a customer-facing knowledge base, an advantage</li>
</ul>
</div>
</div>