Security Engineer II; Detection & SOC Engineering

Security Engineer II (Detection & SOC Engineering)

Lehi, Utah, Open to Remote

At Podium, we bring AI Employees to local businesses that turn every conversation into revenue. Trusted by 60,000+ businesses across Auto, Home Services, and Aesthetics, Podium captures and converts leads 24/7, driving both new business and repeat customers.

In under 24 months, we crossed $100M in AI Agent ARR, scaling 300% year-over-year. During this time, we’ve deployed 10,000 AI employees to empower real business outcomes for our customers. Podium is building what we believe will be the most impactful AI employee ecosystem for local business.

Podium has been recognized as the Best AI Implementation by Inc. Magazine, highlighted by OpenAI for building revenue-driving AI Agents, and awarded the #1 AI Agent for Business Operations by G2.

Our growth is fueled by hiring exceptional people, holding them to high standards, and creating opportunities for them to grow and make an impact. Our operating principles guide daily behavior and ensure we hire people who will thrive  you're hungry for growth, aligned to our operating principles, and ready to get to work, you won't find a better place to learn and accelerate your career.

We are looking for a Security Engineer II to work as a technical leader within our Security Operations function. This role reports directly to our Chief Security Officer.

This is a highly hands‑on role that blends advanced detection engineering, security automation, and incident response leadership. You will design and build high‑fidelity detections, develop custom security tooling, integrate our security stack, and elevate the technical maturity of the SOC.

This is not a people management role — it is an individual contributor position with strong technical influence across the security organization.

• Design, implement, and tune high‑fidelity detections across cloud, endpoint, SaaS, identity, and application environments
• Build and optimize queries, alerts, and correlation logic within our SIEM and EDR platforms
• Participate in SOC on‑call rotation and serve as escalation point for high‑severity incidents.
• Lead complex investigations across endpoint, cloud, SaaS, and identity environments.
• Triage and validate high‑impact alerts, ensuring consistent investigative rigor and documentation.
• Conduct proactive threat hunting to identify gaps in detection coverage.
• Drive continuous improvement of playbooks, runbooks, and case management standards.
• Partner with analysts to improve alert quality, reduce false positives, and elevate overall SOC effectiveness.

• Build custom security tooling to improve alert enrichment, investigation, and response
• Develop integrations between security tools and internal systems via APIs
• Automate repetitive investigative workflows and containment actions
• Improve signal quality and reduce false positives across the stack
• Contribute to guardrails and enforcement mechanisms across cloud and SaaS environments
• Serve as the technical escalation point for high‑severity incidents
• Lead complex investigations and root cause analysis
• Improve and mature incident response playbooks and processes
• Conduct post‑incident analysis and drive systemic improvements

• Raise the technical bar within the SOC through mentorship and code/detection review
• Establish standards for detection quality and investigation rigor
• Partner closely with App Sec, Infrastructure Security, IT, and Engineering
• Help shape the SOC and detection engineering roadmap

• 5–7+ years of experience in security engineering, detection engineering, or security operations
• Strong experience with SIEM platforms
• Experience with EDR platforms
• Strong scripting skills (Python, Bash, or similar)
• Experience working in AWS or similar cloud environments
• Experience leading complex incident investigations

• Experience building internal security tools
• Detection-as-code or infrastructure-as-code experience
• Experience integrating tools via APIs
• Experience mentoring junior analysts or engineers
• Familiarity with SaaS security and identity‑based attack patterns