Senior CSOC Engineer

Posting Open Date: 06/08/2026

Anticipated Posting Close Date*: 08/17/2026

*Job posting may close early due to the volume of applicants.

CSOC Engineer - Security Automation

Fastly is seeking a Security Automation Engineer for our Customer Security Operations Center (CSOC) team, where you'll help design, operate, and evolve the internal security platform and tools that enable our Security Analysts to keep our customers safe.

Day to day, you'll work across the entire stack of our bespoke SIEM and SOAR platform - designing systems, writing production-grade code, and shipping features that have a direct impact on how we protect our customers. You'll work closely with our Security Analysts to deeply understand their challenges, then develop automated security workflows that solve those problems, ensuring the right information is presented at the right time. You'll spot inefficiencies in how we detect and respond to security incidents, and build the tools to eliminate them.

What You'll Do

• Design, develop, and refactor our custom internal security platform across both the backend (FastAPI) and frontend(React)

• Partner with security analysts to turn manual workflows into automated, reliable processes

• Integrate and operationalise AI/ML utilities (such as LLMs) into our security platform to assist analysts with threat investigation and incident summarisation.

• Work with our infrastructure in GCP, using Kubernetes for orchestration and Terraform for resource management

• Leverage our monitoring and alerting tools (Prometheus/Grafana) to detect failures early and maintain high availability across the internal security platform the team owns

• Build and maintain API integrations that connect our detection tools, ticketing systems, and customer environments

• Champion code quality through code reviews, testing practices and CI/CD pipelines.

What We're Looking For

• At least 3 years building and shipping software in a production environment

• Solid proficiency in Python, JavaScript and/or Golang.

• Hands-on experience with Docker, Kubernetes, and cloud providers (we use GCP)

• You know when to build a complex system and when a simple solution is the right call. You care about testing, code quality and monitoring your applications.

• You can explain technical trade-offs clearly and collaborate effectively with a distributed team across time zones.

• Experience guiding and coaching team members, helping others grow alongside you

• You pick up new skills quickly and share what you've learned with the broader team

We'll Be Super Impressed If You Have Experience In Any Of These

• Building or maintaining a custom SIEM or SOAR platform

• Deploying and operationalising Machine Learning models or Large Language Models (LLMs) in production environments

• Working with Event-driven architectures or message queues (e.g. Kafka, Pub/Sub)

• Previous experience at a CDN, cloud provider, or high-traffic platforms

• Working with geographically dispersed teams

Work Hours: 9am-6pm

Work Location(s) & Travel Requirements:

This position is open to remote workers in the following preferred regions:

• San Francisco, CA

• New York, NY

Fastly currently embraces a largely hybrid model for most roles which allows employees flexibility to split their time between the office and home. 

Pursuant to the San Francisco Fair Chance Ordinance and the Los Angeles Fair Chance Initiative for Hiring Ordinance, we will consider for employment qualified applicants with arrest and conviction records.

Salary: The estimated salary range for this position is $142,630.00 to $201,348.00. 

Starting salary may vary based on permissible, non-discriminatory factors such as experience, skills, qualifications, and locatio