Who We Are

Vultr is on a mission to make high-performance cloud infrastructure easy to use, affordable, and locally accessible for enterprises and AI innovators around the world. With 33 global cloud data center locations, Vultr is trusted by hundreds of thousands of active customers across 185 countries for its flexible, scalable, global Cloud Compute, Cloud GPU, Bare Metal, and Cloud Storage solutions. In December 2024 Vultr announced an equity financing at a $3.5 billion valuation. Founded by David Aninowsky and self-funded for over a decade, Vultr has grown to become the world’s largest privately-held cloud infrastructure company.

Vultr Cares

Medical Insurance stipend paid annually

9 Company-Paid Holidays

Generous Leave Policy + 1 month paid sabbatical every 5 years + Anniversary Bonus each year

Professional Development Reimbursement

Internet reimbursement

Fitness membership reimbursement

Company paid Wellable subscription

Join Vultr

Vultr is expanding its India presence and is building its first Global Integrated Operations Command Center (GIOC) in Chennai — the 24x7 nerve center for monitoring, triage, and first response across Vultr’s global security operations.

We are seeking Security Engineers to serve as the first line of response across Vultr’s security signal surface — SIEM, threat, identity, and access alerts. This is a frontline security operations role for engineers who triage SIEM alerts, perform first-line containment, and preserve evidence in real time — and who want to grow into deeper SOC, threat-detection, or security engineering careers. You must be comfortable working a rotational shift model — including nights, weekends, and holidays — to sustain the coverage.

Role Overview

The Security Engineer is the entry point of the GIOC incident lifecycle for the security tower. You monitor security signals, acknowledge and triage alerts within defined first-response SLAs, execute documented runbooks to investigate and contain common security events, and escalate cleanly to Senior Security when an alert falls outside L1 scope. The role ensures fast, accurate first response that protects customer data and platform security.

You operate from a consolidated single-pane-of-glass dashboard, classifying and routing incidents by severity and tower while owning accurate, complete documentation and chain-of-custody for every action. Success is measured by first-response SLA adherence, triage accuracy, and runbook resolution rate. The role runs on a rotational schedule to sustain 24x7 coverage.

Key Responsibilities

Alert Monitoring & First Response

Monitor security signals — SIEM detections, authentication and access anomalies, threat-intel and endpoint alerts — from a consolidated single-pane-of-glass dashboard

Acknowledge alerts and incidents within first-response SLA targets

Perform initial review — validate the detection, rule out false positives, check recent changes, and review the CMDB before acting

Triage & Severity Classification

Classify each alert by severity and potential impact, confirming the owning tower (Security / cross-tower)

Route and assign tickets accurately to the correct tower or escalation path

Sustain triage accuracy at or above the GIOC go-live standard

Reassess severity as the investigation evolves, and declare higher when in doubt — treat suspected breaches as high-severity until ruled out

Runbook-Driven Investigation & Containment

Match alert signatures to documented runbooks and execute permitted L1 actions

Perform first-line containment within L1 scope (e.g., isolate, disable, or block per runbook) and preserve evidence for analysis

Document every step taken, with supporting evidence and timestamps, in the incident ticket

Escalation & Handoff

Escalate unresolved or out-of-scope alerts to the Senior Security Engineers with a clean, complete handoff (symptom · evidence collected · steps tried · current state)

Flag missing or ineffective runbooks and detection gaps for review and continuous improvement

Initiate and support major-incident (Sev-0 / Sev-1) bridges per the escalation matrix; engage Security leads and incident response immediately on suspected breaches