Staff Security Engineer

Company Description

Guardant Health is a leading precision oncology company focused on guarding wellness and giving every person more time free from cancer. Founded in 2012, Guardant® is transforming patient care and accelerating new cancer therapies by providing critical insights into what drives disease through its advanced blood and tissue tests, real-world data and AI analytics. Guardant tests help improve outcomes across all stages of care, including screening to find cancer early, monitoring for recurrence in early-stage cancer, and treatment selection for patients with advanced cancer. For more information, visit guardanthealth.com and follow the company on LinkedIn, X (Twitter) and Facebook. 

The Staff Security Engineer, reporting to the Associate Director of Security Engineering, will be responsible for strengthening Guardant Health’s ability to detect, investigate, and respond to threats. This role focuses on detection engineering, threat intelligence, security automation, and incident response, with an emphasis on infrastructure, cloud, endpoint, and identity security.

You will be a hands-on technical leader working across Security Operations and Security Engineering disciplines to evolve how Guardant Health detects and responds to threats. This role offers the opportunity to wear many hats — from building scalable logging pipelines and modernizing our SIEM, to crafting high-fidelity detections and responding to real-world incidents. You’ll also help shape our emerging strategy around AI-powered defense, including how we securely log, monitor, and assess AI and agent activity across the enterprise.

Duties and Responsibilities:

• Develop and maintain high-fidelity threat detection content, including rules, analytics, and behavioral detections across infrastructure, endpoint, cloud, SaaS and identity platforms.
• Own and enhance detection engineering workflows, including testing, tuning, false-positive reduction, and coverage analysis.
• Partner closely with external MDR provider to develop and refine detection rules, improve investigation quality, and establish effective escalation and response workflows
• Support and participate in incident response, including investigation, containment, eradication, and post-incident reviews.
• Build dashboards, metrics, and reports to measure detection coverage, SOC effectiveness, and security posture.
• Monitor and help secure AWS and cloud-native environments, including CloudTrail, VPC Flow Logs, workload logs, and SaaS integrations.
• Evaluate and implement AI-assisted security capabilities for defense and detection, while also defining how AI systems, agents, and usage are logged, monitored, and assessed for risk.
• Develop documentation, runbooks, and operational playbooks for SOC and security engineering workflows.
• Mentor junior engineers and provide technical leadership within the SOC and security engineering functions.
• Stay current on emerging threats, detection techniques, attacker tradecraft, and security data engineering best practices.

Qualifications:

• 8+ years of experience in security engineering, security operations, detection engineering, or incident response.
• Strong hands-on experience developing, testing, and tuning SIEM and EDR detections across multiple environments.
• Strong background in threat detection and incident response within a SOC environment.
• Experience owning open source threat intelligence platforms such as MISP, Yeti, and OpenCTI.
• Demonstrated ability to improve alert quality, reduce false positives, and incorporate business context into detection and response decisions.
• Experience working with external MDR providers, managed SOCs, or SIEM service partners to improve detection content, investigations, escalations, and response outcomes.
• Strong incident response experience, including leading technical investigations and coordinating containment, eradication, and recovery activities.
• Hands-on experience with EDR platforms
• Experience working with identity and access logs
• Experience investigating threats in AWS environments and working with cloud security telemetry.
• Understanding of AI and machine-learning use cases in security, including detection, automation, and governance considerations.
• Strong written and verbal communication skills including ability to write threat intelligence assessments and reports.
• Ability to work independently and collaboratively in a fast-paced environment.

Preferred Qualifications:

• Experience with detection engineering frameworks (e.g., Diamond Model, MITRE ATT&CK).
• Experience in healthcare, biotech, or other regulated environments.
• Security certifications such as CISSP, GIAC, GCED, GCIA, or cloud security certifications.

AI & Digital Fluency

• Demonstrate curiosity, sound judgment, and the ability to critically evaluate and responsibly leverage AI-enabled tools in accordance with company policies, ethical standards, and regulatory requirements to improve the efficiency, effectiveness, and quality of work.

Hybrid Work Model: This section is applicable to onsite employees who are eligible for hybrid work location as specified by management and related policies.  Guardant has defined days for in-person/onsite collaboration and work-from-home days for individual-focused time. All U.S. employees who live within 50 miles of a Guardant facility will be required to be onsite on Mondays, Tuesdays, and Thursdays. We have found aligning our scheduled in-office days allows our teams to do the best work and creates the focused thinking time our innovative work requires. At Guardant, our work model has created flexibility for better work-life balance while keeping teams connected to advance our science for our patients.

The annualized base salary ranges for the primary location and any additional locations are listed below. This range does not include benefits or, if applicable, bonus, commission, or equity. Each candidate’s compensation offer will be based on multiple factors including, but not limited to, geography, experience, education, job-related skills, job duties, and business need.

Primary Location: Remote - Open Position (USA)
Primary Location Base Pay Range: $133,960 - $184,195
Other US Location(s) Base Pay Range: $133,960 - $184,195
If the role is performed in Colorado, the pay range for this job is: $141,840 - $195,030