Senior CSOC Engineer

<div class="content-intro"><p>Fastly helps people stay better connected with the things they love. Fastly’s edge cloud platform enables customers to create great digital experiences quickly, securely, and reliably by processing, serving, and securing our customers’ applications as close to their end-users as possible — at the edge of the Internet. The platform is designed to take advantage of the modern internet, to be programmable, and to support agile software development. Fastly’s customers include many of the world’s most prominent companies, including GitHub, Yelp, Paramount, and JetBlue.</p> <p>We're building a more trustworthy Internet. Come join us.</p></div><p>Posting Open Date: 06/08/2026</p> <p>Anticipated Posting Close Date*: 08/17/2026</p> <p><em>*Job posting may close early due to the volume of applicants.</em></p> <h2><strong>CSOC Engineer - Security Automation</strong></h2> <p>Fastly is seeking a Security Automation Engineer for our Customer Security Operations Center (CSOC) team, where you'll help design, operate, and evolve the internal security platform and tools that enable our Security Analysts to keep our customers safe.</p> <p>Day to day, you'll work across the entire stack of our bespoke SIEM and SOAR platform - designing systems, writing production-grade code, and shipping features that have a direct impact on how we protect our customers. You'll work closely with our Security Analysts to deeply understand their challenges, then develop automated security workflows that solve those problems, ensuring the right information is presented at the right time. You'll spot inefficiencies in how we detect and respond to security incidents, and build the tools to eliminate them.</p> <p><strong>What You'll Do</strong></p> <ul> <li> <p>Design, develop, and refactor our custom internal security platform across both the backend (FastAPI) and frontend(React)</p> </li> <li> <p>Partner with security analysts to turn manual workflows into automated, reliable processes</p> </li> <li> <p>Integrate and operationalise AI/ML utilities (such as LLMs) into our security platform to assist analysts with threat investigation and incident summarisation.</p> </li> <li> <p>Work with our infrastructure in GCP, using Kubernetes for orchestration and Terraform for resource management</p> </li> <li> <p>Leverage our monitoring and alerting tools (Prometheus/Grafana) to detect failures early and maintain high availability across the internal security platform the team owns</p> </li> <li> <p>Build and maintain API integrations that connect our detection tools, ticketing systems, and customer environments</p> </li> <li> <p>Champion code quality through code reviews, testing practices and CI/CD pipelines.</p> </li> </ul> <p><strong>What We're Looking For</strong></p> <ul> <li> <p>At least 3 years building and shipping software in a production environment</p> </li> <li> <p>Solid proficiency in Python, JavaScript and/or Golang.</p> </li> <li> <p>Hands-on experience with Docker, Kubernetes, and cloud providers (we use GCP)</p> </li> <li> <p>You know when to build a complex system and when a simple solution is the right call. You care about testing, code quality and monitoring your applications.</p> </li> <li> <p>You can explain technical trade-offs clearly and collaborate effectively with a distributed team across time zones.</p> </li> <li> <p>Experience guiding and coaching team members, helping others grow alongside you</p> </li> <li> <p>You pick up new skills quickly and share what you've learned with the broader team</p> </li> </ul> <p><strong>We'll Be Super Impressed If You Have Experience In Any Of These</strong></p> <ul> <li> <p>Building or maintaining a custom SIEM or SOAR platform</p> </li> <li> <p>Deploying and operationalising Machine Learning models or Large Language Models (LLMs) in production environments</p> </li> <li> <p>Working with Event-driven architectures or message queues (e.g. Kafka, Pub/Sub)</p> </li> <li> <p>Previous experience at a CDN, cloud provider, or high-traffic platforms</p> </li> <li> <p>Working with geographically dispersed teams</p> </li> </ul> <p><strong>Work Hours: </strong>9am-6pm</p> <p><strong>Work Location(s) &amp; T