Security Operations Engineer

We are a global B2B SaaS company enabling electronic data interchange (EDI) and connectivity between businesses and their trading partners. Our customers rely on our services to securely exchange business-critical information.

We are looking for a hands-on Security Operations Engineer to investigate and respond to security incidents, resolve security findings, maintain endpoint security controls, and drive our endpoint vulnerability management program.

You will work with Microsoft Entra, Intune, Exchange, Defender and Palo Alto Cortex XDR, partnering with IT, infrastructure, engineering, and support teams to move findings from initial detection through verified resolution. This role combines daily security operations with practical improvements through scripting, detection tuning, and better workflows.

We value our employees with competitive benefits and generous paid time off packages, flexible and casual work environments, career development, recognition programs, and more!

This role is a remote opportunity.

What You'll Do:

Lead security investigations and incident response

• Independently investigate and lead assigned incidents from initial assessment through containment, recovery, and closure.
• Analyze endpoint telemetry, authentication activity, process execution, network connections, and other available evidence to determine scope and impact.
• Perform authorized response actions and coordinate remediation with system owners.
• Escalate high-severity incidents and decisions with significant business or customer impact to Information Security leadership.
• Maintain investigation timelines, evidence, response decisions, and clear stakeholder updates.
• Complete post-incident reviews and track corrective actions through closure.

Own security ticket resolution

• Triage and resolve security tickets generated by Microsoft Defender, Palo Alto Cortex XDR, vulnerability assessments, employee reports, and internal escalations.
• Validate findings, assess risk, distinguish malicious activity from benign behavior, and determine appropriate next steps.
• Remediate findings directly within authorized access and change-control boundaries.
• When another team must implement a fix, provide actionable guidance, establish ownership, track progress, and verify completion.
• Document investigation results, remediation evidence, and closure rationale.
• Identify recurring issues and implement durable improvements rather than repeatedly closing the same alerts.

Drive endpoint vulnerability management

• Own the operational lifecycle of endpoint vulnerability management, including prioritization, remediation coordination, exception tracking, and verification.
• Maintain visibility into assessment coverage, missing or unhealthy agents, unsupported software, and unmanaged or stale devices.
• Prioritize vulnerabilities using severity, exploitability, exposure, and business criticality.
• Coordinate with IT and infrastructure teams responsible for patch deployment and system changes.
• Track remediation against agreed service-level targets and escalate overdue high-risk findings.
• Validate fixes through reassessment or other technical evidence.
• Maintain time-bound exceptions with documented justification, accountable owners, and appropriate approvals.
• Report coverage gaps, overdue exposure, remediation progress, and recurring obstacles.

Improve endpoint security and operational workflows

• Maintain and troubleshoot endpoint security policies, agent health, coverage, and integrations.
• Tune detections and recommend exclusions through documented review and approval.
• Develop practical scripts, investigation queries, dashboards, and integrations that reduce manual work.
• Apply secure engineering practices, including least privilege, protected credentials, logging, testing, and safeguards for disruptive actions.
• Maintain response playbooks, technical documentation, and operational handoffs.
• Support targeted threat hunting and related security engineering improvements as priorities allow.

Collaborate across a global business

• Partner with technical teams to implement security improvements that account for service availability and customer impact.
• Coordinate potentially disruptive containment and remediation through established incident and change management processes.
• Communicate technical findings clearly to both technical and nontechnical stakeholders.
• Participate in a shared on-call rotation with defined escalation paths and backup coverage.

What success looks like

• Success looks like: incidents have clear ownership, timely escalation, complete documentation, and verified corrective actions.
• Success looks like: security tickets reach validated resolution rather than simply being reassigned.
• Success looks like: endpoint protection and vulnerability-assessment coverage gaps are identified and addressed.
• Success looks like: high-risk vulnerabilities are remediated within agreed targets or covered by approved, time-bound exceptions.
• Success looks like: repeated alerts and manual tasks decrease through practical engineering improvements.
• Success looks like: response and remediation decisions account for customer impact and service availability.

Requirements for Success:

• Four+ years of relevant experience in one or more of; security operations, incident response, and/or security engineering.
• Demonstrated ability to independently investigate security incidents and coordinate response through resolution. Experience investigating Entra ID sign-in activity, Conditional Access, Intune-managed devices, and Exchange Online email threats.
• Hands-on production experience with Microsoft Defender for Endpoint or Palo Alto Cortex XDR, with the ability to become proficient in both.
• Experience driving endpoint vulnerability remediation, including prioritization, patch coordination, tracking, and verification.
• Strong Windows troubleshooting skills and working knowledge of endpoint administration, identity security, and networking.
• Ability to interpret endpoint telemetry, process trees, authentication events, and operating-system logs.
• Experience managing findings through a ticketing or security case-management system.
• Practical scripting skills in PowerShell, Python, or Bash.
• Clear written communication and the ability to provide actionable remediation guidance.
• Ability to prioritize competing demands and collaborate with teams across time zones.
• Preferred: Production experience with both Microsoft Defender and Palo Alto Cortex XDR.
• Preferred: Experience with KQL, Cortex XDR query capabilities, or a SIEM platform.
• Preferred: Familiarity with endpoint management and patch-deployment tools.
• Preferred: Experience investigating or securing Linux or macOS systems.
• Preferred: Security operations experience in SaaS or another availability-sensitive environment.
• Preferred: Familiarity with cloud security logs and investigations.
• Preferred: Familiarity with EDI, managed file transfer, AS2, SFTP, APIs, or certificate management.
• Preferred: Relevant certifications (e.g. SC-200, GCIH, GCFA) or equivalent practical experience.

Perks & Benefits

• Remote first and casual work environment
• 401k with 3.5% company match and vested after 2 years
• 20 PTO days - 10 company holidays - 1 birthday day off - 1 Volunteer day - 3 summer days
• Medical, dental, vision and other life/health insurance plans
• Paid parental leave
• Wellness reimbursement program

Who is TrueCommerce?

TrueCommerce is a high-performing global supply chain network that delivers fully integrated, end-to-end supply chain visibility and management. We help some of the world’s leading brands improve supply chain performance, including Schneider Electric, DanoneWave, Siemens, Ocean Spray, and many others.

For additional information, visit our website.

Applicants must be authorized to work for any employer in the U.S. At this time, we are unable to sponsor or take over sponsorship of an employment visa for this role.