Customer Success Engineer (CSE)

Daylight delivers Managed Agentic Security Services (MASS), MDR, threat hunting, and a security data lake, through a fundamentally different architecture than traditional security providers.

Our agentic platform runs the full cycle from detection to response, informed by security experts from IR and threat hunting backgrounds. The platform learns your environment and investigates alerts; experts validate decisions, optimize detections, and take over during incidents.

The result: security teams move from firefighting to strategic work.

We're looking for a Customer Success Engineer to own the technical relationship with a portfolio of customer security teams, from onboarding through steady-state operation. You'll be the go-to technical partner for our customers' security engineers, answering most questions on the spot and serving as first-line response across shared channels. This is not a ticket-routing role: every Daylight account is a live integration project. You'll work alongside a Customer Success Manager who owns the commercial relationship, while you own the technical one.

Responsibilities

Execute onboarding: run the integration checklist against contracted scope, set up escalation paths and on-demand paging, and drive accounts to silent-mode exit with status visible to the customer

Run stale and non-stale activation tracks separately, keeping onboarding moving without CSM follow-up

Serve as live first-line technical response in shared Slack or Teams channels and the Pylon queue

Confirm integrations are live, sending data, and that the response policy is active; catch expiring tokens, lapsed permissions, and unannounced new tooling

Run working sessions with customer security engineers on escalation and response policies, test notification rules end to end, and wire case data into their ticketing until analysts adopt it

Tune detections, false escalations, and the end-to-end case experience

Explain case dispositions clearly enough to expand response scope from investigations to quarantine and isolation

Maintain Pylon knowledge base articles, service differentiator docs, escalation policies, and troubleshooting playbooks

File field observations in Linear so Product and the SOC see what you see

Deliver QBR technical content to the CSM ahead of the deck

Escalate cleanly to the Solutions Architect pool when needed, with the investigation already done

Travel roughly quarterly for customer visits, company events, or conferences

Requirements

4+ years in a customer-facing technical role such as CSE, TAM, Solutions Engineer or Architect, or Implementation Engineer

Background in cybersecurity, ideally with experience in security operations, detection and response, MDR, or SIEM/EDR tooling

Startup or high-growth experience where process is still being built

Ability to hold a technical conversation with a customer's security engineer independently

Hands-on scripting experience

Working knowledge of APIs, SaaS integrations, log pipelines, and modern cloud architecture

Ability to read logs, trace a workflow, isolate root causes, and communicate findings clearly

Strong prioritization and written communication skills across multiple accounts

Experience with structured onboarding and building a customer-facing knowledge base, an advantage