Security Operations Engineer

About the role

Alchemy, a Web3 infrastructure and developer platform, is hiring a Security Operations Engineer in New York. This is a hands-on individual-contributor role focused on improving threat detection, incident investigation and operational security risk, with no people-management duties. AI-assisted engineering and investigation will be part of daily work.

Key responsibilities

• Detect and investigate threats: triage alerts, hunt suspicious activity and investigate across cloud infrastructure, corporate systems, identity, endpoints and production environments.
• Engineer detection coverage: build and tune detections, onboard telemetry and maintain log pipelines, testing rules against attacks and benign activity.
• Respond to incidents: take part in the security on-call rotation, scope, contain and recover, preserve evidence and coordinate with system owners.
• Build AI-assisted security workflows: automate evidence collection, alert enrichment, investigation timelines and response preparation, and evaluate them against known cases and adversarial inputs.
• Reduce operational exposure: partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls and attack-surface monitoring.
• Secure agent operations: work with platform and product-security partners on agent identities, credentials, tool access and audit logging, and build detections for suspicious agent behavior.
• Share reusable code, runbooks and evaluation cases, pair with teammates and review automation.
• Track detection coverage, alert quality, investigation effort, response time and remediation progress.

Required profile

• Hands-on security operations experience in detection engineering, threat hunting and incident response.
• Experience building and using AI-assisted tools in security or adjacent engineering work, with validation of outputs and protection of sensitive information.
• Incident judgment: separating hypotheses from findings, preserving evidence and knowing when to escalate or contain.
• Record of helping teammates through tools, mentoring, code review or documentation.
• Clear written communication and ownership of urgent investigations and follow-through.

Required skills

• Strong scripting and software-building, especially Python, with APIs, version control, tests and production automation.
• SIEM experience such as Splunk or Panther, including detection logic and log analysis.
• Cloud security, identity, endpoint telemetry, networking and Linux.
• Nice to have: AWS, Kubernetes, detection-as-code, SOAR, digital forensics, threat intelligence, securing AI agents and blockchain infrastructure.

What we offer

• Private health insurance and gym reimbursement.
• Commuter benefits and flexible time off.
• In-office group meals and a learning and development stipend.
• Company-sponsored conferences and events, plus a books and audiobook subscription.