Description

Lead security operations, incident response, and detection engineering for enterprise infrastructure.

This role is on-site.

Responsibilities

• Monitor, investigate, and respond to cybersecurity incidents in coordination with SOC, CERT, and CSIRT teams.
• Perform forensic analysis of attack patterns and security events to determine root causes.
• Build, optimize, and maintain SIEM architecture, including log ingestion, parsing, and normalization.
• Develop and fine-tune KQL queries and analytics rules in Microsoft Sentinel to improve detection accuracy.
• Conduct threat hunting, simulate attack scenarios, and analyze threat intelligence feeds to identify emerging threats.

Required Skills

• 8–13 years of relevant cyber security experience in enterprise security operations.
• Strong hands-on experience with Microsoft Sentinel, Microsoft Defender for Cloud, Endpoint, and Identity.
• Proficiency in KQL query development and detection engineering.
• Experience managing SIEM tools, endpoint protection, antivirus, and monitoring systems.
• Knowledge of Azure Active Directory / Entra ID, Office 365 Security, and Exchange Security.
• Understanding of MITRE ATT&CK Framework, firewalls, IDS/IPS, and vulnerability assessment tools.
• Experience with Windows and Linux security administration and cloud security concepts.

Preferred Skills

• Microsoft Certified: Security Operations Analyst Associate (SC-200) or CEH certification.

Key Skills

Education

Bachelor's degree