Senior Security Engineer,Detection & Incident Response
Hands-on senior security engineer on Pure Storage's Prague-based 24/7 security operations team: detection engineering in Splunk, incident response and threat hunting, Python/SOAR automation (Tines/XSOAR), cloud and Kubernetes monitoring, and AI-assisted triage workflows. Primarily in-office in Prague.
- Compensation
- Not disclosed
- Location
- Prague, Czech Republic
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 3+ years
- Category
- Security
- Posted
Skills
Must have
- 6+ years of experience in cybersecurity, incident response, detection engineering, security operations, or a related security discipline
- 3+ years of hands-on experience executing threat hunts, complex incident investigations, or detection engineering within a SOC or SIEM environment
- Deep hands-on experience with Splunk (search, dashboards, alerts, correlation searches, saved searches, deployment server, forwarder management)
- Strong understanding of the complete incident response lifecycle (triage, scoping, containment, eradication, recovery, post-incident learning)
- Strong knowledge of networking, operating systems, cloud environments, and security architecture across identity, endpoint, network, and cloud
- Experience developing Python scripts for data processing, API integrations, security tooling, and automation
- Strong understanding of threat intelligence and attacker frameworks, including MITRE ATT&CK, the Diamond Model, kill chains, and TTPs
- Hands-on experience with threat hunting methodologies, including hypothesis-driven hunting, behavioral baselines, and anomaly detection
- Excellent written and verbal communication skills in English
- Bachelor's degree in Computer Science, Information Security, Engineering, or a related technical field, or equivalent practical experience
Nice to have
- Detection-as-code experience (Sigma, ECMA/JSON formats, Git-backed detection repositories, unit testing, MITRE ATT&CK coverage mapping, Splunk Security Content)
- Hands-on experience with SOAR platforms such as Tines, XSOAR, or Splunk SOAR, including API-driven enrichment and response workflows
- Cloud security operations experience across AWS, GCP, and/or Azure, including CloudTrail, GuardDuty, cloud audit logs, and cloud-native attack surfaces
- Container and Kubernetes security experience, including Falco, runtime monitoring, image scanning, vulnerability management, or software supply chain security
- Experience evaluating or implementing agentic or AI-assisted security workflows, including LLM-assisted investigations or autonomous triage
- Experience operationalizing threat intelligence, including PIRs, CTI-to-detection pipelines, and intelligence-driven threat hunting
- Experience with Python, Bash, Go, or similar languages and exposure to infrastructure-as-code technologies such as Terraform or CloudFormation
- Experience with follow-the-sun security operations models and security operations metrics such as MTTD, MTTA, and MTTC
- Experience with Attack Surface Management, including secret hygiene, identity attack surface, and Shadow AI
- Relevant certifications such as GCIH, GCIA, AWS Security Specialty, CKS, or equivalent
Full description
Everpure (NYSE: P) has evolved from storage pioneer to data platform, closing fiscal 2026 with $3.7 billion in revenue, its first billion-dollar quarter, and accelerating growth into FY27. Our strategic agenda spans the companies defining the next era of technology - hyperscalers, AI labs, the AI hardware supply chain, data platform providers, and the broader AI ecosystem.
This type of work—work that changes the world—is what the tech industry was founded on. So, if you're ready to seize the endless opportunities and leave your mark, come join us.
THE ROLE
Everpure is seeking a hands-on Senior Security Engineer to drive security operations from our Prague, Czech Republic location. In this role, you will contribute to operational excellence across incident response, threat hunting, threat intelligence integration, detection engineering, and security automation, bringing real-time visibility and rapid response to our 24/7 global security operations environment.
This is a technical delivery and execution role, not a traditional monitoring position. You will work closely with detection engineers, threat intelligence analysts, incident response leadership, and our global Security Operations teams to build and refine detections, improve signal quality, execute threat hunts, automate workflows, and respond to complex security incidents with speed and precision.
Success in this role is measured not by alert volume, but by signal quality, real threat detection, incident containment speed, automation maturity, and the effectiveness of response workflows.
WHAT YOU'LL DO
- Detection Engineering: Design, implement, and maintain detections in Splunk and related security platforms. Develop detection-as-code content using formats such as YAML/JSON, incorporate unit and regression testing, map coverage to MITRE ATT&CK, and contribute to Sigma/YARA-L coverage expansion.
- Incident Response & Triage: Investigate suspicious activity and participate in incident triage, scoping, containment, eradication, recovery, and post-incident reviews. Use lessons from investigations to continuously improve detection and response processes.
- Threat Hunting: Execute hypothesis-driven threat hunts using MITRE ATT&CK, the Diamond Model, kill chains, threat intelligence, behavioral baselines, and anomaly detection. Correlate signals across endpoint, cloud, identity, SaaS, network, and other security telemetry to identify real threats and operational blind spots.
- Detection Quality: Continuously tune detections to improve true-positive rates and reduce alert fatigue. Identify which signals provide meaningful security value and refine detection logic based on investigation outcomes and changes in the threat landscape.