Security Operations Engineer

Holistiplan is seeking a Security Operations Engineer to support day-to-day security operations for its financial planning platform. The role focuses on AWS security, detection and incident response, vulnerability and application security, and SOC 2 compliance, working closely with the CISO and engineering.

Responsibilities:

• Monitor and assess AWS environments (IAM, VPC, S3, KMS, CloudTrail, GuardDuty, Security Hub) and drive remediation of misconfigurations or exposed resources
• Review infrastructure changes for security implications; partner with engineering on secure architecture patterns
• Investigate configuration drift and IAM privilege escalation risks, escalating high-impact findings to the CISO
• Support patch management across AWS infrastructure (EC2 OS-level patching, AMI/golden image currency, AWS Systems Manager Patch Manager), with CISO/CTO sign-off on production-impacting changes
• Build, tune, and maintain detection rules and dashboards in Datadog Security Monitoring
• Triage security alerts, perform investigation, and escalate confirmed incidents per the IR playbooks
• Reduce alert fatigue through signal tuning, correlation logic, and false-positive analysis
• Contribute to log source coverage gap analysis (mapped to MITRE ATT&CK where applicable)
• Monitor and respond to endpoint alerts via EDR/XDR tooling; investigate suspicious process activity and isolate compromised hosts, escalating for containment decisions
• Correlate signal across endpoint, identity, network, and cloud telemetry within the XDR platform to identify multi-stage attacks that single-source alerting would miss
• Help maintain EDR/XDR agent health/coverage across the fleet and tune detection policies to reduce false positives
• Support onboarding of new telemetry sources into the XDR platform and help evaluate detection coverage against the MITRE ATT&CK framework
• Use AI tools to accelerate detection, triage, response, and documentation
• Evaluate and pilot AI-assisted security tooling, with appropriate data handling safeguards
• Help build internal playbooks/prompts that make the security team faster without compromising data governance
• Serve as a responder during security incidents: triage, containment, eradication, and recovery per the IR plan
• Perform initial forensic analysis on affected hosts, cloud resources, and accounts (log review, timeline reconstruction, scope determination)
• Support post-incident activities: root cause analysis, lessons-learned documentation, and tracking of remediation actions to closure
• Participate in tabletop exercises to validate IR readiness and identify playbook gaps
• Support breach assessment activities in partnership with the CISO; final notification decisions rest with the CISO and legal/compliance
• Own recurring vulnerability scanning across cloud infrastructure, endpoints, and application layers
• Triage and prioritize identified vulnerabilities and relevant CVEs by exploitability and business impact
• Track remediation against SLA targets; own patch execution for AWS infrastructure and partner with engineering on application-layer and third-party dependency fixes
• Maintain vulnerability management metrics and reporting for internal stakeholders and audit evidence
• Monitor threat intelligence feeds and vendor advisories for vulnerabilities relevant to Holistiplan's stack; lead with impact/action, not just background, when summarizing findings
• Review and triage findings from existing SAST, DAST, and software composition analysis (SCA/dependency scanning) tools
• Prioritize identified vulnerabilities by exploitability and business impact and route to engineering for remediation
• Track remediation progress against SLA targets and maintain reporting for audit evidence
• Support periodic access reviews and entitlement recertification (least-privilege validation across AWS, SaaS tools, and internal systems)
• Assist in drafting and maintaining security policies, standards, and procedures; support annual policy review cycles
• Track and log policy exceptions per governance process
• Contribute security metrics and status updates for board/executive-level reporting
• Support SOC 2 Type II control testing, evidence collection, and remediation tracking
• Conduct internal control walkthroughs and identify gaps against frameworks (SOC 2 CC series, NIST CSF, CIS Controls)
• Maintain and update risk register entries, control documentation, and audit evidence repositories
• Partner with engineering to close audit findings on schedule
• Support third-party/vendor security risk assessments, including review and summarization of vendor security questionnaires
• Help map applicable regulatory requirements (e.g., GLBA, CCPA) to internal controls and flag gaps for CISO/legal review

Requirements:

• 2–4 years of experience in security operations, cloud security, or a related analyst/engineer role
• Hands-on experience securing and monitoring AWS environments (IAM, VPC, S3, CloudTrail, GuardDuty, SecurityHub)
• Experience with a SIEM platform
• Experience with Endpoint Detection and Response (EDR) and/or Extended Detection and Response (XDR) tools (e.g., CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR)
• Hands-on incident response experience — triage, containment, and post-incident root cause analysis
• Experience supporting a vulnerability management program, including scan tooling, CVE triage, and remediation tracking
• Familiarity with using AI/LLM tools for security workflows (triage, enrichment, documentation) with an understanding of associated data-handling risks
• Experience supporting internal audits or compliance programs (SOC 2, ISO 27001, NIST CSF, or similar)
• Familiarity with GLBA, CCPA, or other financial data privacy regulations sufficient to help map requirements to controls
• Solid understanding of common attack techniques and the MITRE ATT&CK framework
• Working familiarity with SAST/DAST/SCA tool output — comfortable reading and triaging findings
• Clear written communication — you'll document findings for auditors, engineers, and leadership alike
• direct Datadog Security Monitoring experience
• Experience in fintech or regulated financial services environments
• Scripting ability (Python, Bash) for automation of detection or audit workflows
• A security certification such as Security+, GCIH, GCFA, or AWS Security Specialty