Security Operations Engineer

About Alchemy

• Alchemy is the Web3 infrastructure and developer platform that powers millions of users and the world’s most innovative blockchain applications. From enabling $1+ trillion in financial transactions worldwide to scaling L2s and enabling DeFi, Alchemy provides the infrastructure and tools developers need to build reliable, scalable, and accessible experiences.
• Trusted by companies like JPMorgan, Stripe, Visa, Franklin Templeton, Nike, and backed by a16z, Coatue, Silver Lake, Lightspeed, and Stanford University, Alchemy is building the foundational layer for a decentralized and AI-enabled Web3 ecosystem. For more information, visit alchemy.com
• .

The Role

• We're looking for a Security Operations Engineer to improve how Alchemy detects threats, investigates incidents, and reduces operational security risk. This is a hands-on individual-contributor role with no people-management responsibilities.
• You'll investigate suspicious activity and build the systems that make the next investigation faster and more reliable. AI-assisted engineering and investigation should be part of your daily work: connecting evidence, developing detections, building response workflows, and checking the results against source data.
• You'll also help the team get better at this work. Through shared tooling, code review, pairing, and practical documentation, you'll give teammates capabilities they can use independently.

What You Will Do

• Detect and investigate threats.
• Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments. Establish what happened from evidence and communicate uncertainty clearly.
• Engineer detection coverage.
• Build and tune detections, onboard useful telemetry, and maintain reliable log pipelines. Test rules against representative attacks and benign activity; address missing coverage and noisy alerts.
• Respond to incidents.
• Participate in the security on-call rotation and incident response, including scoping, containment, recovery, and post-incident improvements. Preserve evidence and coordinate changes with system owners.
• Build AI-assisted security workflows.
• Automate evidence collection, alert enrichment, investigation timelines, and response preparation. Connect agents to approved tools and data sources so they can complete bounded tasks with traceable results.
• Verify before trusting.
• Evaluate AI-assisted workflows against known cases and adversarial inputs. Require evidence for conclusions, test false-positive and missed-threat behavior, and keep human approval for disruptive containment actions.
• Reduce operational exposure.
• Partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls, and attack-surface monitoring. Prioritize findings by exposure and impact, then verify remediation.
• Help secure agent operations.
• Work with platform and product-security partners on operational controls for agent identities, credentials, tool access, and audit logging. Investigate misuse and build detections for suspicious agent behavior.
• Improve how the team works.
• Share reusable code, investigation skills, runbooks, and evaluation cases. Pair with teammates, review automation, and teach approaches they can apply to their own investigations.
• Measure defensive outcomes.
• Track detection coverage, alert quality, investigation effort, response time, and remediation progress. Use those measures to decide what to improve next.

What We Are Looking For

• Hands-on security operations experience spanning detection engineering, threat hunting, and incident response.
• Strong scripting and software-building ability, especially Python; experience with APIs, version control, tests, and operating automation in production.
• Experience with a SIEM such as Panther, Splunk, or an equivalent platform, including detection logic and log analysis.
• Working knowledge of cloud security, identity, endpoint telemetry, networking, and Linux systems. Ability to investigate across system boundaries.
• Evidence of building and using AI-assisted tools in security or adjacent engineering work. You can show how you validate outputs, handle failures, and protect sensitive information.
• Sound incident judgment: you can separate a hypothesis from a finding, preserve evidence, and choose when to escalate or contain.
• A record of making teammates more effective through tools, mentoring, code review, or documentation, without needing management authority.
• Clear written communication and the willingness to own both urgent investigations and the follow-through that prevents repeat incidents.

Helpful Experience

• AWS, Kubernetes, bare-metal infrastructure, detection-as-code, or SOAR workflows.
• Digital forensics, threat intelligence, or testing detections through attack simulation.
• Securing AI agents and tool integrations, including prompt injection, credential misuse, and data-exfiltration risks.
• Blockchain infrastructure or other environments with sensitive keys and high-impact production systems.

What Success Looks Like

Investigations reach evidence-backed conclusions faster. Detection coverage improves, repeat noise declines, and remediation is verified. The team adopts tools and workflows you've built, with clear limits on what agents may do and a tested path for handling failures.

Benefits & Perks

• 🏥 Private Health Insurance
• 💪 Gym Reimbursement
• 🚅 Commuter Benefits
• 🌴 Flexible Time Off
• 🥙 In-Office Group Meals
• 🧠 Learning & Development Stipend
• 🌎 Company Sponsored Conferences & Events
• 🎧 Books & Audiobook subscription with
• Bookster