We're building the AI-driven future of customer success, from retention to growth
We're building the AI-driven future of customer success, from retention to growth Gainsight is the AI-powered retention engine behind the world's most customer-centric companies. The Gainsight CustomerOS platform orchestrates the customer journey from onboarding to outcomes to advocacy. More than 2,000 companies trust Gainsight's applications and AI agents to drive learning, adoption, community connection, and success for their customers. To explore how our suite of solutions is shaping the future of customer success, check out the link.
We're looking for a full-time Cloud Security Operations Engineer to join our Security team reporting to the Senior Manager, AI Response & Threat. This role is a remote role based in Mexico.
In this role, you'll play a key role in strengthening our cloud detection and response practice by defending multi-cloud environments, building cloud detection coverage, leading incident investigations, and developing the tooling and processes that make the team more effective. This is a great opportunity for someone who thrives in a complex enterprise environment and enjoys working cross-functionally with teams like engineering and technical and non-technical stakeholders. The adecuado candidate brings strong skills in cloud security operations, incident response, and SIEM detection engineering.
Triage and investigate alerts end-to-end across cloud-native tooling (GuardDuty, Sentinel, Security Command Center), determining severity and scope and closing with documented findings
Detect and respond to cloud-specific threats, including identity compromise, privilege escalation, access key and token abuse, misconfiguration exploitation, and data exfiltration from cloud storage




Build detections on cloud audit logs (CloudTrail, Azure Activity and Entra ID logs, GCP Cloud Audit Logs), network flow logs, and container and workload telemetry
Run proactive threat hunts using ATT&CK-aligned; methods, including the Cloud and Containers matrices, to surface attacker activity that automated detection has missed
Build automation for cloud containment actions, such as credential revocation, instance isolation, and policy quarantine
Lead incident response from scoping and containment through post-incident review, performing forensics across cloud, host, network, and memory, and reporting clearly to technical and non-technical stakeholders
Build, tune, and maintain SIEM correlation rules and Sigma-based detection-as-code pipelines that reduce noise and improve signal quality
Participate in the on-call rotation, maintain operational runbooks, and contribute to red and purple team exercises
This role may require occasional travel (up to 10-20%) for team meetings, training, or company events. 4+ years in security engineering, SOC operations (T2/T3), or incident response within a complex enterprise environment, including 3+ years defending production cloud workloads
~ Bachelors Degree (or equivalent experience) and/or 5 years of related experience
~ Strong knowledge of cloud security architecture and telemetry in at least one major provider (AWS, Azure, or GCP),



including the log sources needed for effective detection and investigation
~ Deep understanding of cloud IAM and identity-based attack paths, such as role assumption abuse, federation weaknesses, and long-lived credential compromise
~ Hands-on experience investigating real cloud incidents using native cloud logs and forensic acquisition methods
~ Experience with cloud-native threat detection services and with ingesting and normalizing cloud logs in a SIEM
~ Working knowledge of core cloud infrastructure (compute, storage, networking, and serverless) sufficient to assess risk and advise on remediation
~ Digital forensics experience across host, network, and memory artifacts, including memory acquisition, disk imaging, and multi-source timeline correlation
Scripting in Python, PowerShell, or Bash, with production automation, log enrichment, or tooling integrations to show for it
Relevant Professional Certifications: GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer
CSPM/CNAPP or cloud workload protection experience (Wiz, Prisma Cloud, Defender for Cloud, Orca)
Experience in multi-cloud environments
Container and Kubernetes security (EKS, AKS, GKE), including runtime threat detection and image scanning
IaC for cloud guardrails and security configuration (Terraform, CloudFormation)
SOAR experience (XSOAR, Splunk SOAR, Torq), including playbook development, API integrations, and case management
Relevant Professional Certifications: GCIH, GCFE, GCIA, GCDA, OSCP, AWS Security Specialty, or GCP Professional Cloud Security Engineer
Why You'll Love It Here:
What underpins it all is a culture that offers the stability,

📌 Cloud Security Operations Engineer (Ciudad de México)
🏢 Gainsight
📍 Ciudad de México