Description

You will architect and implement detection, monitoring, and alerting systems to defend against evolving threats.

This role is remote.

Responsibilities

• Design detection architectures from the ground up, including logging, monitoring, and rule tuning.
• Develop and deploy advanced detection logic and rules across SIEM and EDR platforms.
• Engineer policy and logic to support specific detection and response use cases.
• Automate log ingestion, data enrichment, and alert triage processes.
• Collaborate with stakeholders to align detection strategies with business risks and improve SOC processes.

Required Skills

• Hands-on experience configuring and setting up detection systems.
• Expertise in architecting detection and monitoring systems rather than just operating tools.
• Proficiency writing detection rules using SPL, KQL, Sigma, or YARA.
• Practical experience with CrowdStrike, Wiz, Proofpoint, Tenable, and ServiceNow.
• Broad experience across SIEM, EDR, ITDR, and email security tools.
• Deep understanding of threat actor TTPs, MITRE ATT&CK, and the cyber kill chain.
• Scripting experience in Python or PowerShell for automation tasks.
• Proven ability to influence SOC and detection strategy.

Key Skills

Education

Not specified