About the role
What we're looking for:
We need someone with 2-5 years of experience in security operations who has hands-on incident response and detection engineering skills. You should be comfortable working in a cleared (TS/SCI) environment, operating on Linux systems, and navigating AWS cloud infrastructure. Bonus points if you've done memory forensics, threat hunting, or have a systems engineering/administration background.
What you'll do:
- Rotate through on-call incident response shifts, triaging human-generated tickets and driving security incidents to resolution
- Triage and analyze machine-generated alerts from our SIEM (Splunk) and custom alerting platforms, identifying real threats from noise
- Build and maintain detection logic and alerting strategies across cloud-based infrastructure (primarily AWS and Linux)
- Conduct focused threat hunting exercises across network segments to identify existing compromises and develop new detections
- Perform host forensics, memory forensics, network forensics, and log analysis in support of investigations
- Write automation to accelerate alert triage and incident response workflows
- Onboard new log sources and engineer detection coverage for new infrastructure components
- Collaborate closely with cloud infrastructure and cloud ops teams operating in the high-side environment
- Contribute to the broader Palantir security operations mission beyond the USG-specific team
- Write clear technical summaries of security incidents for distribution to senior stakeholders
