Skip to main content
All roles

Security Operations Engineer

Location: Fully remote, between PT (UTC-8) and CET (UTC+1).

We're looking for a mid-level Security Operations Engineer to join us as Pydantic's second dedicated security hire, working closely with our Security & Compliance Lead and across the organization to improve security in our cloud, corporate, and developer environments. We're an AI-first startup where security is a shared responsibility of every engineer. Engineers own the security of the systems they build and operate; the security team brings specialist knowledge and focus, building tooling and guardrails and helping others investigate and address risk.

You'll work directly with engineers and make secure practices part of everyday development and operations. You'll also be the backstop: surfacing risks that fall between teams and systems and driving them to resolution. You'll turn our security backlog into shipped, tested improvements: building integrations, implementing controls, writing detections, and reducing toil. You'll question assumptions and propose changes based on what you've seen work (or fail) elsewhere while balancing delivery against ongoing investigations and emerging risks.

This is a hands-on SecOps engineering role, focused on protecting Pydantic and our customers by monitoring, investigating, and securing our core environments:

  1. Corporate, SaaS & endpoints: Defending Google Workspace, connected SaaS tooling, and our macOS fleet using MDM and EDR.
  2. Cloud: Working with platform engineers to improve security in our Google Cloud Platform (GCP) environment.
  3. GitHub: Safeguarding our code, branch policies, secret detection, and developer workflows.

AI tools are part of how we build and operate every day. You'll use tools such as Claude Code, OpenAI Codex, and Pydantic AI, alongside Model Context Protocol (MCP) servers connected to our security, platform, and back-office systems, to write and review automation, develop detections, investigate incidents, and author postmortems. You'll be responsible for validating their outputs and making sound engineering and security decisions.

This role could suit you if you've worked as a:

  • Detection and Response Engineer investigating threats across cloud, corporate, and developer environments.
  • SIEM Engineer building and maintaining security data pipelines, parsers, and detection rules.
  • Platform, Systems, or DevOps Engineer with experience in practical defensive security and SIEM/EDR telemetry.

Your goal is to deliver practical security improvements from our backlog, build high-signal detections, and run day-to-day security operations: triaging alerts, responding to incidents and vulnerabilities from first report to verified fix, and keeping our monitoring and controls healthy. Along the way, you'll help every engineer build and operate securely. Success means shipping working controls and automation, resolving incidents and vulnerabilities quickly and cleanly, reducing risk, and identifying the next improvements that matter most.

1. Detection & incident response across corporate, cloud, and GitHub

  • Corporate & SaaS: Ingest and analyze telemetry across Google Workspace (MFA, suspicious logins, and account changes) and connected SaaS applications.
  • Endpoints & macOS: Secure and monitor our macOS fleet through MDM and EDR; respond to host-level alerts, phishing attempts, and endpoint anomalies.
  • Cloud: Work with platform engineers to investigate suspicious activity and improve cloud audit logging, access controls, and governance.
  • GitHub: Protect repository access and third-party app permissions, secure our software supply chain, and catch leaked credentials and tokens.

2. Build & operate with AI

  • Use modern AI tools (Claude Code, Codex, and Pydantic AI) as part of your daily engineering workflow to implement backlog items, develop and test detections, automate response playbooks, and analyze security telemetry.
  • Use MCP servers (e.g., for our compliance platform, Google Workspace admin, Slack, and Logfire) to let AI agents query systems, triage findings, and gather evidence, scoping their credentials and permissions sensibly as you go.

3. Identity, access & security guardrails

  • Improve access controls across Google Workspace and connected SaaS applications, including MFA, OAuth app permissions, and account lifecycle management.
  • Partner with platform engineers on cloud access controls and automated configuration checks, building on their infrastructure expertise.

4. Technical control automation & incident runbooks

  • Maintain tested, practical incident response runbooks and automated workflows for key threat vectors.
  • Build and maintain reusable security agent skills that turn runbooks into repeatable workflows for triage, investigation, evidence collection, and response, with clear permissions, tested behavior, and human review for sensitive actions.

5. Vulnerability response & triage

  • Triage vulnerability reports and scanner findings across our code, dependencies, endpoints, and cloud: assess real exploitability and customer impact, set priority, and route fixes to the engineers who own the affected systems.
  • Respond quickly to newly disclosed vulnerabilities and supply chain incidents (compromised packages, leaked secrets) by working out which of our systems are exposed, driving remediation, and verifying it.
  • Track remediation to closure, keep noise low by suppressing false positives, and automate recurring triage so engineers see only findings that need action.

6. Operationalize Logfire for security operations

  • Turn Logfire, our own observability platform, into our SIEM: bring in Google Workspace, GitHub audit, endpoint, and cloud telemetry, then build the detections, queries, dashboards, and alerts to investigate incidents end to end.
  • Instrument our security automation and AI agents with Logfire, and feed what you learn back to the Logfire team as one of its most demanding internal users.
  • Tune out false alarms so every alert that fires is high-signal and actionable.

7. Deliver the backlog & improve how we work

You'll work with our Security & Compliance Lead to prioritize the backlog and tackle incidents, with their support on escalations and risk decisions.

  • Work with our existing security engineer and engineering teams to turn agreed priorities into scoped changes, implement them, and verify that they reduce risk in practice.
  • Identify coverage gaps, recurring operational problems, and opportunities for improvement through investigations and day-to-day engineering work; bring concrete proposals into the backlog.
  • Help engineers own security in their systems through reusable tooling, clear documentation, and practical collaboration on fixes.
  • Experienced in SecOps, detection, and incident response. You must have at least 4 years of experience working in security operations, SOC/detection engineering, or platform security.
  • Hands-on with SIEM and EDR. Direct experience working with SIEM platforms (Splunk, Elastic) and modern EDR tooling (e.g., SentinelOne, CrowdStrike) to investigate telemetry, detect threats, and triage alerts.
  • Fluent on the command line. You're quick in a Unix shell and reach for standard and open-source tools (grep, jq, curl, osquery, and the like) to triage an alert, parse logs, and collect evidence, whether on a laptop or a remote server.
  • Hands-on with Google Workspace security. You understand identity and access management, MFA, audit logs, and OAuth app permissions, and can investigate suspicious account activity from the endpoint to the cloud.
  • Comfortable in a small startup team. You work independently, ask for context when needed, and adapt as priorities change and the organization grows. You enjoy sharing responsibility with other engineers and helping them build security into their own work.
  • An engineer who ships. You can take a scoped security problem from investigation through implementation, testing, and rollout. You're comfortable working through an existing backlog while using your judgment to spot gaps and suggest better approaches.
  • Experienced in vulnerability triage and response. You can judge whether a vulnerability is actually exploitable in our context, prioritize accordingly, and work with engineers to get it fixed, rather than forwarding scanner output.
  • Experienced with macOS & MDM. Practical experience securing macOS environments and administering endpoint policies through MDM (e.g., Jamf, Kandji, Fleet DM).
  • Strong at scripting and automation. You write clean Python, Bash, or Go to query APIs, parse JSON logs, and wire up alerts. You prefer fixing root causes and automating guardrails over creating paperwork.
  • Strong async communicator. Most of our work is remote and async. You document incidents cleanly, write clear runbooks, and explain technical risks clearly. You also know when to switch to real-time communication to resolve misunderstandings, especially when the stakes are high.

Nice to have:

  • An undergraduate degree in computer science or engineering from a leading university or institute of technology.
  • Observability experience: OpenTelemetry, log pipelines, or SQL-based analytics that you can apply to security operations in Logfire.
  • Security agent development: reusable agent skills or agents for red or blue team workflows, built with Pydantic AI or frameworks such as Eve, Mastra, ADK, or the OpenAI Agents SDK.
  1. Required: Live and work in a time zone between PT (UTC-8) and CET (UTC+1).
  2. Required: Able to travel to the EU, UK, and US up to 4 times a year to join our off-sites.
  3. Required: Fluent in English.

Pydantic Validation is the data validation library that powers modern Python development - 500 million downloads per month, used by virtually every tech company you've heard of. Why? Because we obsess over developer experience and write code we'd actually want to use ourselves.

We're applying that same engineering mindset to Pydantic Logfire, our observability platform with first class support for AI engineering, built for today's development reality: AI workloads, multi-language environments, and cloud infrastructure that's designed to be straightforward to set up and maintain.

We build with technologies developers actually want to work with:

  • OpenTelemetry for standardized instrumentation
  • SQL for intuitive querying (no proprietary query language to learn)
  • Rust, Python, and TypeScript for performance and productivity
  • Postgres, DataFusion, and object storage for scalable backends

Unlike other companies that pay lip service to open source, we commit over 20% of our engineering team to maintaining and expanding our open source ecosystem. This includes the core Pydantic Validation library and Pydantic AI - our rapidly growing framework that's becoming the standard for AI application development. We're signatories of the open source pledge and build on open standards because we believe in interoperability, not lock-in. Use our OpenTelemetry-based SDK with any compatible backend - we're confident you'll choose us on merit.

We're backed by Sequoia Capital and run a fully remote team across multiple time zones, with regular in-person offsites.

Join our team of exceptional engineers who value substance over hype, practical approaches over perfectionism, and meaningful progress over busyness. We've built a culture that balances technical ambition with sustainable practices—minimal meetings and respect for your expertise and time. We're creating tools that genuinely improve developers' lives, and we're looking for thoughtful contributors who share our commitment to quality and our passion for elegant solutions.

  • 💰 Compensation: Competitive salary and stock options
  • 🌍 Truly Remote: Work from anywhere within our timezone range - no office requirements
  • 🌐 Global & Diverse: Join a multi-cultural team of 8+ nationalities
  • 💪 Impact: Direct influence on tools used by millions of developers worldwide
  • 🎯 Focus on Growth: Regular opportunities for learning and professional development
  • 🤝 Team Gatherings: Connect with the team at our regular international off-sites
  • 🏥 Healthcare: Comprehensive health coverage for you and your dependents
  • 🎮 Flexible Hours: Work when you're most productive
  • 💻 Equipment: Budget for your home office setup
  • ⚖️ Work-Life Balance: flexible working hours and 33 days PTO no matter where you live (including public holidays, which you can choose to take or not)

Application

To make your application stand out, please share your GitHub profile/project portfolio and an example of an interesting security or data problem you've solved with agents.

Apply now

No recruiters or agencies please. Unsolicited recruiters will be marked as spam.