ID.me
Staff Cloud Detection & Response Engineer
McLean, Virginia · Staff+ · Full-time
Sponsorship not specified$63k-$800kDetected 7 days ago
PythonGoBashNode.jsAWSGCPCloud PlatformsKubernetesTerraformCI/CDLinuxSite Reliability EngineeringMachine LearningLLMsCybersecurityNetwork SecuritySIEMDetection EngineeringIncident ResponseComplianceLeadershipAdaptabilityCISSP
Stay score
odds of building a lasting career here
59Sponsors, lottery-bound
Cap-exempt (no lottery)0
Sponsors this role80
Entry-level history0
PERM / green-card track0
Lottery odds (Level IV)94
Fits your clock70
Sponsors, but it's cap-subject — you still face the weighted lottery (~61% per draw at Level IV). Good if you win; have a cap-exempt backup on your list.
Lottery odds assume a STEM candidate.
Personalize to your clock →Employer immigration record
from this employer's Department of Labor filings
Files H-1B transfers
6 transfer filings in the last year, covering 6 workers. Median labor-condition decision: 8 days. An employer that already files transfers is one that can take over an existing H-1B.
Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.
Community outcomes
No reports yet — be the first to help the next applicant.
About the role
- ID.me is seeking a Staff Cloud Detection & Response Engineer to serve as our senior technical authority on threat detection and incident response across our cloud environments.
- This is a defender-first role, not an engineering or SRE role
- Your primary mission is detecting, investigating, and eliminating threats across our cloud infrastructure, Kubernetes workloads, and CI/CD surface.
Responsibilities
- Lead high-severity cloud security incidents with full technical authority from initial detection through containment, eradication, and recovery across cloud infrastructure, Kubernetes (EKS/GKE), and CI/CD-deployed workloads.
- Advise engineering and platform teams on secure-by-design cloud architecture, IAM least-privilege structures, network security perimeters (e.g., AWS Organizations SCPs / VPC Service Controls), and workload identity, serving as a technical reviewer and consultant rather than the engineer implementing the change.
- Drive visibility into CI/CD pipelines for security signals (such as dependency/SBOM findings, secret-scanning alerts, and admission-control violations) surfaced to your team for detection and response, rather than owning the pipeline configuration itself.
- Perform proactive threat hunting for IOCs and APT TTPs specific to cloud and container environments, translating cloud-native telemetry (CloudTrail/Cloud Audit Logs, VPC/network flow logs, Kubernetes audit logs) into concrete detections.
- Own incident command during major cloud incidents by directing cross-functional responders, making real-time containment decisions, and communicating status to executive leadership without needing to escalate the decision upward.
- Lead root-cause and post-incident review for cloud incidents, translating findings into concrete architectural recommendations that platform/engineering teams own and implement.
- Stay current on cloud-native security services and emerging cloud attack techniques, and drive their adoption into detection content and incident playbooks.
- ID.me maintains a work environment free from discrimination, where employees are treated with dignity and respect.
- Consumers can verify their identity with ID.me once and seamlessly login across websites without having to create a new login and verify their identity again.
- Over 600 consumer brands use ID.me to verify communities and user segments to honor service and build more authentic relationships.
Requirements
- 8+ years of experience in information security, with extensive hands-on experience in incident response, threat hunting, and forensic analysis.
- 3+ years leading incident response in cloud environments (AWS and/or GCP required).
- Scripting/automation proficiency (Python, Go, bash) for detection engineering and forensic tooling.
- Deep, hands-on knowledge of Kubernetes (EKS/GKE) and container runtime security, covering container escape scenarios, runtime protection, admission control, and image scanning/provenance.
- 4+ years detecting, analyzing, and mitigating complex threats using SIEM (e.g., Chronicle, Splunk), EDR, DLP, IDS/IPS, and CSPM/CWPP tooling.
- Demonstrated ability to run incident command with authority by directing response across teams during a high-severity, high-visibility cloud incident.
Nice to have
- Experience across both AWS and GCP is a plus, but not required.
- Familiarity with Infrastructure as Code (Terraform) and GitOps workflows sufficient to review and advise on security guardrails, even without direct authorship responsibility.
- Experience with service mesh security policy (Istio, Linkerd) from an investigative/advisory standpoint.
- Advanced certifications: GCIA, GCIH, GCFA, CISSP, CKS (Certified Kubernetes Security Specialist), or a cloud provider security certification (AWS Security - Specialty, GCP Professional Cloud Security Engineer).
- Experience with AI/ML-assisted triage and detection engineering, and awareness of securing AI/LLM pipelines.
- Proficiency leading forensic investigations across Linux, MacOS, and Windows in addition to cloud environments.
- Prior experience contributing to SOC/IR process maturity and incident command frameworks.
- Exercises decisive, high-authority judgment in high-pressure, high-severity incidents without waiting for permission to act.
Compensation
- $154,000 - $199,000 USD
- ID.me adheres to these principles in all aspects of employment, including recruitment, hiring, training, compensation, promotion, benefits, social and recreational programs, and discipline.
Benefits
- Over 175 million users experience streamlined login and identity verification with ID.me at 22 federal agencies, 50 state government agencies, and more than 100 healthcare organizations.
Company info
- At ID.me, we embrace the thoughtful use of AI tools in our daily work and there are even occasions where we leverage AI in our hiring process.
Equal opportunity
- In addition, ID.me's policy is to provide reasonable accommodation to qualified employees who have protected disabilities to the extent required by applicable laws, regulations and ordinances where a particular employee works.
This listing is sourced directly from ID.me's careers page and normalized into a canonical job model.