Description

You will serve as a Tier 3 lead for incident detection, investigation, and response activities.

Responsibilities

• Lead incident response activities, providing hands-on support during high-priority security events.
• Manage and configure Rapid7 InsightIDR and InsightConnect, including log source integration and custom parser development.
• Conduct in-depth threat analysis to differentiate false positives from genuine intrusions.
• Automate repetitive SOC tasks and enhance response processes using Python, PowerShell, Ansible, or Puppet.
• Develop and maintain playbooks in Rapid7 InsightConnect to orchestrate SOC operations.
• Lead investigations escalated by Level 1 analysts and ensure thorough documentation.
• Identify security gaps and recommend measures for risk mitigation.

Required Skills

• 15+ years of relevant experience in cybersecurity.
• 3-4 years of recent domain-specific experience.
• Advanced configuration and rule development in Rapid7 InsightIDR (XDR+SIEM).
• Hands-on experience with Rapid7 InsightConnect (SOAR).
• Proficiency in automation and scripting with Python, PowerShell, and Bash.
• Experience using Ansible and Puppet for configuration management and standardization.
• Strong understanding of firewalls, IDS/IPS, antivirus, EDR, and behavioral analytics.
• Practical knowledge of API integrations for security toolsets and custom reporting.
• Familiarity with incident response frameworks such as NIST, MITRE ATT&CK, or SANS.
• Bachelor’s degree in Computer Science, Cybersecurity, IT, or equivalent professional experience.

Preferred Skills

• Relevant certifications such as GCIH, CEH, CISSP, or Rapid7 InsightIDR certifications.
• Certifications related to Ansible or Puppet.

Key Skills

Education

Not specified