Security Engineer
Summary
Security engineer focused on incident response, detection engineering, IR automation, and building AI-enriched triage pipelines, working with Python and cloud platforms (GCP/AWS).
Join us in bringing joy to customer experience. Five9 is a leading provider of cloud contact center software, bringing the power of cloud innovation to customers worldwide.
Living our values everyday results in our team-first culture and enables us to innovate, grow, and thrive while enjoying the journey together. We celebrate diversity and foster an inclusive environment, empowering our employees to be their authentic selves.
Responsibilities
- Incident response. Own incidents end to end: scoping, containment, forensics, write-up, and remediation follow-through.
- Detection engineering. Write, tune, test, and retire detections. Detection content is version controlled, reviewed, and measured on outcomes rather than alert volume.
- IR automation. Build playbooks, integrations, and workflows that remove repeated manual steps from the response process. This is a large part of the role.
- Threat intelligence. Track activity relevant to our environment and convert it into detections, hunts, and hardening work.
- Threat hunting. Be a contributor to our hypothesis-led threat hunting initiatives.
- AI-assisted development. Build and improve the agents, prompts, and enrichment logic behind the triage pipeline.
- Alert triage. A limited amount: escalations the pipeline surfaces, plus the feedback that improves it.
- Hands-on security operations experience, including incidents you can walk through in detail.
- Proficiency in at least one scripting language (Python or equivalent) and a preference for solving recurring problems with code.
- Working knowledge of detection logic, log pipelines, and modern telemetry sources: EDR, identity, cloud, network, and SaaS.
- Ability to take an ambiguous problem, define what done looks like, build it.
- Clear written communication: incident timelines, design notes, and postmortems.
- GCP and/or AWS experience, including cloud logging, IAM, and cloud-specific failure modes.
- Low-code automation platforms such as Tines or n8n, and judgment about when a workflow should become production code.
- Agent programming and prompt engineering, specifically LLM tooling reliable enough for operational use.
- Experience with AI-enriched detection or triage pipelines.
You will be given problems rather than tickets, and you are responsible for the solution and the reasoning behind it. There is no micromanagement and minimal handholding. This suits people who self-direct and are candid when something is not working. It does not suit people who need an assigned queue.
Work Location: This role is fully remote for candidates who reside outside the 30 mile radius of one of our offices. For candidates who reside within a 30 mile radius of one of our offices, this role is Hybrid and would require 3 days a week (T, W, TH) in office.
As part of our continued commitment to diversity, equity, and inclusion, Five9 supports pay transparency during the entire recruitment process. Actual compensation packages are based on several factors that are unique to each candidate including, but not limited to: skill set, depth of experience, certifications, and specific work location. The range displayed reflects the minimum and maximum target for new hire salaries for the job across the United States. Your recruiter can share more about the specific compensation package during your hiring process.
Additionally, the total compensation package for this position may also include an annual performance bonus, stock, and/or other applicable incentive compensation plans.
Our total reward package also includes:
- Health, dental, and vision coverage, beginning on the first day of employment. Five9 covers 100% of the employee portion of the health, dental and vision coverage and shares a high portion of the dependent cost. We also offer Short & Long-Term Disability, Basic Life Insurance, and a 401k saving plan with employer matching.
- Access to an innovative mental health support platform that offers personalized care and resources in areas such as: therapy, coaching and self-guided mindfulness exercises for all covered employees and their covered dependents.
- Generous employee stock purchase plan.
- Paid Time Off, Company paid holidays, paid volunteer hours and 12 weeks paid parental leave.
All compensation and benefits are subject to the requirements and restrictions set forth in the applicable plan documents and any written agreements between the parties.
Five9 embraces diversity and is committed to building a team that represents a variety of backgrounds, perspectives, and skills. The more inclusive we are, the better we are. Five9 is an equal opportunity employer.
View our privacy policy, including our privacy notice to California residents here: .
Note: Five9 will never request that an applicant send money as a prerequisite for commencing employment with Five9.
As published by greenhouse
First Name, Last Name, Email, Phone, Resume/CV, Cover Letter, Location
- Preferred First Name optional
- How did you hear about opportunities at Five9?
- If you were referred by a current Five9 employee please enter the employee's name here: optional
- Select which best describes your right to work in the US? choose one
- Do you have hands-on security operations experience that includes owning incidents end to end — scoping, containment, forensics, and remediation — with specific incidents you can walk through in detail, including the decisions you made and their outcomes? choose one
- Do you have practical experience writing detection logic, including version-controlled detection content that has been tuned, tested, and measured against outcomes across modern telemetry sources such as EDR, identity, cloud, or SaaS log pipelines? choose one
- Are you proficient in Python or an equivalent scripting language, and have you built security automation workflows — such as IR playbooks, SOAR integrations, or response automations — that eliminated recurring manual steps from an operational process? choose one
- Do you have hands-on experience building or improving AI-assisted tooling for security operations — such as LLM-based enrichment logic, agent workflows, or prompt engineering for triage pipelines — with a practical understanding of where that tooling fails in production? choose one
- Are you comfortable working in a self-directed environment where you are given problems rather than tickets, expected to define what done looks like, and held accountable for both the solution and the reasoning behind it — without an assigned queue or structured escalation path? choose one
- Are you available to work standard Pacific Time hours (9:00 AM – 5:00 PM PT)? choose one
- Are you a current Five9 employee? If so, please apply through the Internal Job Board in Greenhouse. choose one · optional
- Candidate comments: written answer · optional