Description

Monitor network traffic, endpoint logs, and cloud security events to detect and respond to threats.

This role is on-site.

Responsibilities

• Monitor network traffic, endpoint logs, and cloud security events for anomalous behavior and potential security incidents.
• Create, maintain, and tune Splunk correlation searches, alerts, and dashboards to minimize false positives and improve detection.
• Investigate security incidents, preserve forensic evidence, and collaborate with IT and network teams to remediate threats.
• Develop and refine detection and response playbooks based on threat intelligence and frameworks like MITRE ATT&CK.
• Onboard new data sources with infrastructure teams to ensure log integrity, parsing, and normalization across the SIEM platform.

Required Skills

• 8+ years of experience in cybersecurity or security engineering.
• Expert-level proficiency with Splunk, including search processing language (SPL) and dashboard creation.
• Hands-on experience with cloud platforms: AWS, Azure, and GCP.
• Strong understanding of incident response procedures and forensic analysis.
• Knowledge of MITRE ATT&CK framework and threat intelligence integration.
• Experience with SIEM log integration, parsing, and normalization.
• Bachelor's degree in Computer Science, Information Security, or related field.

Preferred Skills

• Experience generating compliance reports and supporting audit readiness.
• Ability to develop detection use cases from scratch.

Key Skills

Education

Bachelor's degree