23andMe Research Institute is looking for an experienced Security Operations Engineer to join our Security Operations team. In this role you will lead security incident response as Incident Commander, triage and investigate alerts, and build the detection and automation architecture to help protect our customer and corporate data. You will bring critical thinking skills, hands-on experience, and the ability to work with and influence cross-functional teams.

Since 2006, 23andMe Research Institute’s mission has been to help people access, understand, and benefit from the human genome. We are a group of passionate individuals pushing the boundaries of what’s possible to help turn genetic insight into better health and personal understanding.

Detection engineering and investigation

• Design, build, and tune threat detections, and measure and improve their fidelity over time.
• Operate and extend our detections-as-code pipeline, from detection logic through testing and deployment, utilizing Terraform.
• Triage, investigate, and prioritize security alerts across endpoint, identity, cloud, and application telemetry, separating true events from background noise.
• Conduct proactive threat hunting informed by current attacker tradecraft.
• Identify automation opportunities and build integrations that reduce manual response effort.

Incident response

• Serve as Incident Commander on a shared rotation, coordinating response across Engineering, IT, Legal, and Privacy for the duration of an incident.
• Maintain and improve incident response runbooks and playbooks based on what you learn in real incidents.
• Track open incidents through closure, confirm corrective and preventive actions, and report incident metrics to security leadership.

Working across the company

• Partner with Engineering, IT, Research, and Compliance to build security automation, and measure whether it reduces detection and response time in practice.
• Participate in an on-call rotation; eligible for an additional on-call bonus.

• 4+ years in security operations, detection engineering, or incident response.
• Detection-as-code experience, or a background in building response automation.
• Demonstrated hands-on experience with threat detection, threat hunting, and incident investigation, including working directly with logs and telemetry to establish root cause.
• Proficiency in at least one scripting language (Python preferred) and familiarity with common operating systems.
• Experience acting as, or deputy to, the lead responder on at least one significant security incident.
• Proficiency with EDR and SIEM platforms, and familiarity with a modern enterprise stack such as Okta, AWS, CrowdStrike or SentinelOne, Datadog, Sumo Logic, or Splunk.
• Clear verbal and written communication, including the ability to stay composed under incident pressure and brief both technical and non-technical audiences.
• Bachelor's degree in Computer Science, Information Systems, or a related field, or an equivalent combination of education and experience.

• Experience applying AI-assisted tooling to triage, correlation, or investigation workflows; our stack includes Claude, Bedrock, Copilot, and OpenAI.
• Experience in a regulated or privacy-sensitive environment (health, genomics, financial services).