Customer Success Engineer (CSE)

About the role

Daylight delivers Managed Agentic Security Services (MASS), MDR, threat hunting, and a security data lake, through a fundamentally different architecture than traditional security providers.

Our agentic platform runs the full cycle from detection to response, informed by security experts from IR and threat hunting backgrounds. The platform learns your environment and investigates alerts; experts validate decisions, optimize detections, and take over during incidents.

The result: security teams move from firefighting to strategic work.

We're looking for a Customer Success Engineer to own the technical relationship with a portfolio of customer security teams, from onboarding through steady-state operation. You'll be the go-to technical partner for our customers' security engineers, answering most questions on the spot and serving as first-line response across shared channels. This is not a ticket-routing role: every Daylight account is a live integration project. You'll work alongside a Customer Success Manager who owns the commercial relationship, while you own the technical one.

Responsibilities

Execute onboarding: run the integration checklist against contracted scope, set up escalation paths and on-demand paging, and drive accounts to silent-mode exit with status visible to the customer

Run stale and non-stale activation tracks separately, keeping onboarding moving without CSM follow-up

Serve as live first-line technical response in shared Slack or Teams channels and the Pylon queue

Confirm integrations are live, sending data, and that the response policy is active; catch expiring tokens, lapsed permissions, and unannounced new tooling

Run working sessions with customer security engineers on escalation and response policies, test notification rules end to end, and wire case data into their ticketing until analysts adopt it

Tune detections, false escalations, and the end-to-end case experience

Explain case dispositions clearly enough to expand response scope from investigations to quarantine and isolation

Maintain Pylon knowledge base articles, service differentiator docs, escalation policies, and troubleshooting playbooks

File field observations in Linear so Product and the SOC see what you see

Deliver QBR technical content to the CSM ahead of the deck

Escalate cleanly to the Solutions Architect pool when needed, with the investigation already done

Travel roughly quarterly for customer visits, company events, or conferences

Requirements

4+ years in a customer-facing technical role such as CSE, TAM, Solutions Engineer or Architect, or Implementation Engineer

Background in cybersecurity, ideally with experience in security operations, detection and response, MDR, or SIEM/EDR tooling

Startup or high-growth experience where process is still being built

Ability to hold a technical conversation with a customer's security engineer independently

Hands-on scripting experience

Working knowledge of APIs, SaaS integrations, log pipelines, and modern cloud architecture

Ability to read logs, trace a workflow, isolate root causes, and communicate findings clearly

Strong prioritization and written communication skills across multiple accounts

Experience with structured onboarding and building a customer-facing knowledge base, an advantage

Posting text as published by Daylight Security.

The evidence behind this listing

Workplace

Remote Matched in posting text

Seniority

Not established

Employment type

Not established

Location as listed

United States - Remote

Pay and work authorization

Stated pay

Not stated

Visa sponsorship

Not stated

Security clearance

Not established

Citizenship

Not established