Senior Security Engineer, Detection & Response (SOC)
PrizePicks is maturing Information Security's detection, incident response, and forensics capabilities, and is looking for a seasoned SOC engineer to help lead that effort alongside the existing team. This is a hands-on role spanning monitoring, triage, response, and forensics, with real ownership over how the program evolves from here.
The role involves owning detection and monitoring, building incident response playbooks, leading threat hunting, and maturing digital forensics capability. It also includes driving automation for response and responding to incidents as they occur. The engineer will document incidents and root causes, own post-incident reviews, and shape how the program measures itself and scales.
- Own Detection & Monitoring: Own how we monitor and triage events and alerts ingested into the SIEM, working with the team to tune detection content, reduce false positives, and close coverage gaps.
- Build the Playbooks: Lead the design and continuous improvement of incident response playbooks, so response is consistent and repeatable across the team, even when you're not the one running it.
- Threat Hunt: Lead our threat hunting practice, proactively hunting for malicious or anomalous activity that alerting and automated detection don't catch.
- Mature Forensics Capability: Strengthen our digital forensics capability, including the processes and tooling that support investigations and evidence handling.
- Automate the Response: Drive automation for alerting, enrichment, and triage across the team's workflows to cut manual toil and reduce time to respond.
- Respond to Incidents: React to and lead response on incidents as they fire, coordinating across business partners as needed.
- Document and Learn: Document incidents, root cause, and remediation with clarity and rigor.
- Own Post-Incident Reviews: Build a structured, blameless post-incident review process, with real root-cause analysis, action items tracked to closure, and follow-through that goes beyond a debrief call.
- Mature the Program: Shape how the program measures itself and scales, evolving IR metrics, escalation paths, and priorities over time.
- Experience building or significantly maturing a SOC/IR function, as opposed to operating one that's already fully staffed. You've helped take a program from early-stage to production-ready (required).
- 5+ years in a SOC, incident response, or detection engineering role, with demonstrated ownership of an IR or monitoring program, outside of queue work (required).
- Strong grasp of the full incident response lifecycle: preparation, detection, containment, eradication, recovery, and lessons learned (required).
- Hands-on SIEM experience: log ingestion, correlation rules, detection tuning. Specific platform is flexible (required).
- Experience with forensic analysis and evidence handling across host and cloud environments (required).
- Comfort building automation/scripting for triage and response (Python or similar) (required).
- Working knowledge of cloud environments (AWS/GCP/Azure) and common attacker TTPs (MITRE ATT&CK) (required).
- Ability to define risk in both technical and business-relevant terms (required).
- Clear written communication: this role produces the playbooks and incident documentation the rest of the team relies on (required).
- Relevant certifications (GCIH, GCFA, GCIA, OSCP, or equivalent) (nice-to-have).
- SOAR platform experience (nice-to-have).
- Prior experience in fintech, gaming, or another high-fraud-risk industry (nice-to-have).
- Experience running detection and IR in a distributed/remote workforce, leaning on endpoint and identity signals rather than a centralized network perimeter (nice-to-have).
- Company-subsidized medical, dental, & vision plans.
- 401(k) plan with company match.
- Annual bonus.
- Flexible PTO to encourage a healthy work/life balance (2 weeks STRONGLY encouraged!).
- Generous paid leave programs, including 16-week paid parental leave and disability benefits.
- Workplace flexibility and modern work schedules focused on getting the job done, not hours clocked.
- Company-wide in-person events and team outings.
- Lifestyle enhancement program.
- Company equipment provided (Windows & Mac options).
- Annual performance reviews with opportunities for growth and career development.
PrizePicks is a daily fantasy sports operator headquartered in Atlanta, Georgia. Its app lets players predict whether athletes will beat or fall short of projected statistics, and it has added prediction-market contracts regulated by the US Commodity Futures Trading Commission. In January 2026 the lottery and gaming group Allwyn completed the purchase of a 62.3% majority stake, with PrizePicks continuing as a standalone brand.