Staff Security Engineer (Security Operations)

Join Pantheon, a leading webops platform, as a Staff Security Engineer (SecOps). In this strategic and technical role, you will define and execute the long-term direction for detection, response, and operational resilience. You will also serve as Pantheon's lead on EU regulatory requirements, ensuring operational controls meet the necessary standards. This is a hands-on role with leadership expectations, where you will shape the broader engineering organization's approach to security and mentor engineers across teams in security best practices.

• Define, own, and execute a multi-year roadmap for Pantheon’s security operations capability, covering detection engineering, incident response, threat intelligence, exposure management, and abuse prevention.
• Lead the architecture of Pantheon’s SecOps toolchain (SIEM, SOAR, EDR/XDR, cloud security posture, identity monitoring), evaluate, select, and integrate security platforms.
• Own the incident response programme end-to-end: playbooks, runbooks, severity frameworks, post-incident reviews, and continuous improvement cycles. Lead response for the most complex and critical incidents.
• Expert-level knowledge of attack techniques and threat actor tradecraft (MITRE ATT&CK, MITRE D3FEND) and the ability to translate that into detection logic and response procedures
• 10+ years of experience in information security, with 7+ years focused on security operations — spanning detection engineering, incident response, threat hunting, or SecOps programme leadership
• Strong hands-on background in cloud-native security across GCP and/or AWS — including logging pipelines, cloud security posture management, and IAM monitoring
• Demonstrated experience leading major incident response — including managing stakeholders, running cross-functional war rooms, and driving post-incident improvement
• Experience owning or materially contributing to EU regulatory compliance requirements (GDPR, NIS2) from an operational security perspective
• Track record of influencing technical direction beyond your immediate team — through design reviews, architecture documents, or cross-functional programme leadership
• Excellent written and verbal communication skills with the ability to present technical risk clearly to both engineering audiences and executive leadership
• Deep expertise in architecting and operating enterprise-grade SIEM and SOAR platforms at scale (e.g., Chronicle, Splunk, Elastic SIEM, Palo Alto XSOAR, Tines)
• Proficiency in scripting and automation (Python, Bash, or equivalent) applied to security engineering problems — not just tooling configuration
• Exposure to bug bounty programme operations and red team/purple team collaboration to validate detection coverage
• Prior experience working within the Irish or EU regulatory environment — familiarity with the Data Protection Commission (DPC), NIS2 obligations for essential/important entities, or ENISA guidance is a plus
• Background in abuse monitoring, phishing detection, and takedown coordination with registrars, hosting providers, and law enforcement
• Experience managing security vendor relationships, running RFPs, and making build-vs-buy decisions for operational tooling
• Hands-on with threat intelligence platforms (e.g., Recorded Future, Mandiant Advantage) and structured intelligence lifecycle management
• Experience building or scaling a detection engineering programme from the ground up, including establishing detection coverage metrics and a continuous improvement cadence
• Holding one or more recognized security certifications: CISSP, CISM, GIAC (GCIA, GCED, GREM, GDAT), OSCP, or a cloud security specialty certification (GCP Professional Cloud Security Engineer, AWS Security Specialty)