This is a hands-on, deeply technical, high-trust role. It's not a support escalation path, it's a strategic one. You'll shape how customers succeed , and you'll shape product by bringing the reality of SOC analysts, detection engineers, threat hunters and incident responders back to our R&D and product teams.
What You'll Do
Be the technical and security authority customers trust
Own the post-sales technical and security relationship for a portfolio of customers, acting as their primary trusted advisor.
Lead onboarding and implementation, data indexing, detection onboarding and tuning, environment configuration, end to end.
Diagnose and resolve complex issues across log pipelines, cloud integrations, detections, automations and permissions.
Partner directly with customer security teams, cloud engineers, and security leadership during investigations and escalations.
Assist customers with building custom AI skills within the platform to solve their pain points.
Drive real adoption, not just go-lives
Conduct technical health checks and lead business reviews with a bias toward action.
Monitor customer health proactively, identify risks early, and intervene before they become problems.
Help customers unlock the full value , not just check a deployment box.
Shape the product from the field
Work directly with engineering and product teams to escalate issues and push them toward resolution.
Translate what you see in the field, real patterns, real friction, real gaps, into product influence.
Be the voice of the customer in rooms where roadmap decisions actually get made.
Advocate for the shift in the industry towards agentic detections and leveraging AI skills to solve security teams' pain points.
Show up in person when it counts
Travel to customer sites for key engagements (~25% of the time).
6+ years in a technical, customer-facing role (TAM, Customer Engineer, Senior Support, or similar).
Hands-on experience with SIEM or observability platforms, Splunk, Elastic/ELK, Microsoft Sentinel, or equivalent.
You've actually used these tools for incident investigation, threat hunting, or application troubleshooting, not just sold them.
Strong cloud fundamentals across AWS, Azure, and/or GCP Infrastructure-as-Code experience (Terraform or similar).
Scripting skills in Python and/or Bash Comfortable troubleshooting distributed systems, data pipelines, and query performance.
Equally fluent talking to engineers and executive stakeholders.
Startup or high-growth experience, you know how to move fast and make calls without a perfect playbook.
You make progress where others stall. You navigate ambiguity with curiosity, not paralysis. You know when to go heads-down and when to loop in the right person, and you do it without being asked.
