Senior Datadog Security & Observability Engineer

Keeper Security, Inc. is one of the fastest-growing cybersecurity software companies that protects thousands of organizations and millions of people in over 150 countries. They are seeking a Senior DataDog Engineer to join their DevOps team, focusing on detection engineering, SIEM operations, and security observability across Keeper’s production and corporate environments.

Responsibilities:

• Own and continuously improve Datadog Cloud SIEM, security monitoring and observability capabilities across production and corporate environments
• Design, build and maintain detection and telemetry capabilities across Datadog, SentinelOne, Wiz and related security platforms
• Develop, test and tune high-fidelity Datadog detection rules aligned to real-world attack scenarios and adversary behaviors
• Improve alert quality by reducing false positives, eliminating noise and increasing detection accuracy
• Design and maintain Datadog log pipelines, processors, parsing rules, facets, indexes, archives and retention strategies
• Implement and mature detection-as-code practices for scalable, version-controlled and testable rule management
• Define and enforce logging, telemetry and instrumentation standards across cloud infrastructure, applications, endpoints and identity systems
• Build and optimize log ingestion, parsing, normalization, enrichment and routing workflows
• Automate onboarding of new telemetry sources and improve visibility across production and corporate environments
• Correlate signals across Datadog, EDR, cloud, identity and security platforms to improve detection depth and investigation quality
• Partner with Security Operations to improve triage workflows, incident response readiness and escalation quality
• Build Datadog dashboards, monitors, analytics and reporting that support operational decision-making across Security, SRE and Engineering
• Map and maintain detection coverage against MITRE ATT&CK and identify telemetry and detection gaps
• Perform detection gap assessments and evolve use cases based on threat intelligence, threat hunting and emerging risks
• Collaborate with cloud, infrastructure, product and compliance teams to strengthen secure logging and observability patterns throughout the software development lifecycle
• Use AI-assisted tools such as Claude, ChatGPT or similar platforms to support query development, detection engineering, investigations, automation and technical documentation

Requirements:

• 4+ years of Datadog experience in detection engineering, SIEM engineering, security engineering, and security observability
• Deep, hands-on production experience administering and engineering Datadog in complex cloud environments
• Strong experience with Datadog Cloud SIEM, Log Management, Security Monitoring, dashboards, monitors and alerting
• Experience designing and maintaining Datadog log pipelines, processors, parsing rules, facets, indexes and retention strategies
• Experience building, testing and tuning detection rules, correlation logic and investigation workflows in Datadog
• Strong understanding of security telemetry across cloud, endpoint, identity and application environments
• Experience with log parsing, normalization, enrichment and pipeline management
• Strong knowledge of AWS and cloud-native infrastructure
• Proficiency with scripting or automation using Python, PowerShell or similar languages
• Experience using Datadog APIs, Terraform or similar infrastructure-as-code tools to automate configuration and platform management
• Solid understanding of modern detection strategies, attacker behaviors and the MITRE ATT&CK framework
• Ability to troubleshoot complex issues across logs, metrics, traces, infrastructure and application telemetry
• Strong communication skills and the ability to collaborate across Security Operations, Engineering, Infrastructure and SRE teams
• Ability and willingness to use AI-assisted tools effectively to improve query development, detection analysis, troubleshooting, automation and documentation
• Experience with SentinelOne, Wiz or related cloud and endpoint security platforms
• Experience with Datadog Application Performance Monitoring, Infrastructure Monitoring, distributed tracing or synthetic monitoring
• Experience optimizing Datadog ingestion volume, indexing, retention and platform cost
• Experience with SOAR, workflow automation or response orchestration
• Familiarity with Sigma or other detection-as-code frameworks
• Experience operating Datadog across large-scale, multi-account or multi-region AWS environments
• Experience in high-scale SaaS, cloud-native or security product environments
• Familiarity with zero-trust architectures, identity-centric security and privileged access management
• Bachelor's degree in Computer Science, Engineering, or related field