Remote opportunity at
GoodLeapStaff Security Engineer, Security Operations
GoodLeap is a technology company that builds financing and software solutions for sustainable home upgrades, including solar energy systems, heat pumps, and efficient windows. The organization…
Career Tools
About This Role
GoodLeap is a technology company that builds financing and software solutions for sustainable home upgrades, including solar energy systems, heat pumps, and efficient windows. The organization relies on proprietary, AI-powered developer tools and applications to facilitate financing transactions totaling over $30 billion since 2018. The firm also supports the nonprofit GivePower, which deploys clean water and electricity infrastructure globally. The company is currently seeking a remote Staff Security Engineer focused…
Job Description
GoodLeap is a technology company that builds financing and software solutions for sustainable home upgrades, including solar energy systems, heat pumps, and efficient windows. The organization relies on proprietary, AI-powered developer tools and applications to facilitate financing transactions totaling over $30 billion since 2018. The firm also supports the nonprofit GivePower, which deploys clean water and electricity infrastructure globally.
The company is currently seeking a remote Staff Security Engineer focused on Security Operations to protect its cloud platforms, endpoint devices, applications, and corporate networks. This position involves developing and fine-tuning threat detections, managing incident response efforts, and overseeing security tools across cloud, identity, endpoint, and email systems. The individual in this role will engineer AI-powered automation and agents to accelerate detection and remediation workflows, while monitoring enterprise AI tool usage and integrations for anomalous behaviors and exposure risks.
This opportunity is well-suited for an experienced security professional who can collaborate closely with software engineering, infrastructure, IT, and compliance partners. The person holding this position will shape security requirements, conduct risk evaluations, oversee technologies such as CrowdStrike and email security solutions, and mentor engineering teams to mature operational security capabilities.
Responsibilities
- Design, create, test, and tune threat detections across endpoint, identity, cloud, and email telemetry using detection-as-code principles mapped to MITRE ATT&CK
- Oversee security logging systems, SIEM platforms, and alerting pipelines
- Monitor enterprise artificial intelligence activity, including agents, AI tools, API keys, and model context protocol integrations for misuse or data exposure
- Lead containment, investigation, eradication, and recovery procedures during security incidents
- Maintain incident response playbooks, runbooks, and plans while conducting tabletop exercises and post-incident reviews
- Deploy and administer security tools such as web application firewalls, intrusion detection systems, DDoS protection, endpoint detection and response, and email security
- Build automated scripts and artificial intelligence agents for alert enrichment, triage, investigation, and response
- Analyze findings from penetration tests and vulnerability scans to propose mitigating controls or remediation steps
- Provide guidance and mentorship to internal security personnel and partner engineering groups regarding detection and operations
- Assist in building out the security team and scaling operational security capabilities
Requirements
- In-depth proficiency in Amazon AWS security configuration, tooling, and logging including GuardDuty, Security Hub, and CloudTrail
- Practical background in detection engineering, SIEM query languages, and detection-as-code
- Direct experience conducting host, cloud, and log investigations during incident response
- Familiarity with the OWASP Top 10 and the MITRE ATT&CK framework
- Solid understanding of web and network protocols like DNS, TCP/IP, TLS, HTTP, and HTTPS
- Familiarity with or ability to quickly master endpoint detection and response platforms, with a preference for CrowdStrike Falcon
- Familiarity with or ability to quickly ramp up on email security covering business email compromise, DMARC, SPF, DKIM, and phishing
- Background in building automation utilities using Python or comparable programming languages
- Experience developing or integrating LLM-based workflows and agents
- Understanding of artificial intelligence risks like prompt injection, excessive agent permissions, and data leakage
- Experience operating within a PCI-DSS, ISO, or SOC 2 control environment
- Strong verbal and written communication skills across messaging, ticketing, and traditional channels
Qualifications
- GCIH certification
- GCFA certification
- GCDA certification
- CCSP certification
- CISSP certification
- CrowdStrike certification
Core Skills
Benefits
- Eligibility for a company bonus
- Eligibility for equity compensation
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, the posting explicitly lists the remote status as remote.
What is the salary range for this role?
The annual base pay ranges from $167,400 to $212,500, varying by location, with potential eligibility for a bonus and equity.
What are the primary technical domains involved in this role?
The role focuses on security operations, detection engineering, incident response, cloud security in AWS, and monitoring artificial intelligence activity across enterprise tools and agents.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.