Description

You will lead Tier 3 incident detection, investigation, and response activities.

This role is hybrid.

Responsibilities

• Lead incident response for high-priority security events, providing hands-on support.
• Manage and configure Rapid7 InsightIDR and InsightConnect, including log source integration and custom parser development.
• Conduct in-depth threat analysis to differentiate false positives from genuine intrusions.
• Automate repetitive SOC tasks and enhance response processes using Python, PowerShell, Ansible, or Puppet.
• Lead investigations escalated by Level 1 analysts and ensure thorough documentation of findings.

Required Skills

• 15+ years of relevant experience in cybersecurity, with 3-4 years of recent domain-specific experience.
• Advanced configuration and rule development in Rapid7 InsightIDR (XDR+SIEM).
• Hands-on experience with Rapid7 InsightConnect (SOAR) for playbook development.
• Proficiency in automation and scripting with Python, PowerShell, and Bash.
• Experience using Ansible and Puppet for configuration management and standardization.
• Strong understanding of firewalls, IDS/IPS, antivirus, EDR, and behavioral analytics.
• Practical knowledge of API integrations for security toolsets and custom reporting.
• Familiarity with incident response frameworks such as NIST, MITRE ATT&CK, or SANS.
• Bachelor’s degree in Computer Science, Cybersecurity, IT, or equivalent professional experience.

Preferred Skills

• Relevant certifications such as GCIH, CEH, CISSP, or Rapid7 InsightIDR certifications.
• Certifications related to Ansible or Puppet.

Key Skills

Education

Not specified