Description

You own Security Operations Center duties, including incident response, malware analysis, and continuous monitoring.

This role is on-site.

Responsibilities

• Triage alerts and incidents, performing deep analysis and correlating findings with threat intelligence (IOCs, TTPs) to identify attack scope.
• Prioritize and triage security alerts, escalating incidents to Tier 3 when remediation exceeds SLA.
• Analyze logs, network traffic, and data sources to identify incident sources and record vulnerabilities, creating remediation tickets.
• Build internal scripts, tools, and automation processes to improve detection and response capabilities.
• Adjust security tools and processes, such as modifying EDR alerting or updating detection rules.

Required Skills

• 5+ years of experience in Security Operations or Incident Response.
• Strong understanding of threat categories, including malware, phishing, Defense-in-Depth, and MITRE ATT&CK framework.
• Working knowledge of M365 Security tools, Azure, AWS, and GCP.
• Experience with SIEM tools like Sentinel, Splunk, or Elastic, and other security tools (EDR, firewalls, IDS/IPS).
• Strong knowledge of Windows, Linux, and/or Mac OS for log investigation.
• Good understanding of networking protocols (SMTP, HTTP, HTTPS, FTP, DNS, DHCP).
• Experience with query languages and scripting languages.
• Familiarity with security orchestration, automation, and response (SOAR) tools.

Preferred Skills

• Bachelor's degree in a related field.

Key Skills

Education

Bachelor's degree