Security Operations Engineer

Atlanta, Georgia, United States

As a member of the Security Operations Center (SOC) team, the Security Engineer will be responsible for early and accurate detection, response, and containment of threats directed against the environment. This role requires advanced skills in intrusion detection and threat hunting to identify credible risks/adversaries to proprietary and sensitive data before a potential breach. Collaboration with other security engineers, developers, vendors and business units to constantly improve the overall security posture will be the key to success.

• Monitor and analyze network, server, endpoint, database, and application activities for indicators of compromise, minimizing false positives.
• Automate alert collection, prioritization, tasks and processes, periodic audits, and controls.
• Lead incident response efforts, conducting thorough remediation and root cause analysis.
• Enhance security posture for large-scale customer-facing hybrid cloud environment and internal workplace, leveraging MITRE ATT&CK tactics and techniques.
• Drive growth and maturity of threat hunting program to proactively identify and mitigate security threats.
• Contribute to security process enhancement and documentation, briefing SOC leadership on cybersecurity developments.
• Evaluate and conduct proof-of-concepts for innovative technologies, collaborating with security engineers on implementation.
• Foster cross-departmental integration to establish strong business relationships, mentor business units in cybersecurity guidelines and best practices while promoting knowledge sharing and maintaining high customer service levels.

• Experience in cybersecurity operations and incident response, including SIEM platforms, IDS/IPS, and Vulnerability Management
• Experience working with large, complex networks and systems
• Bachelor of Science degree in Information Security, Engineering, Computer Science or related field (preferred)
• Proficiency with MITRE ATT&CK framework (or other industry frameworks)
• Programming/scripting experience (bash, Python, Power Shell)
• Knowledge of log ingestion pipelines, log parsing, grok patterns and regular expressions
• Ability to write detections using YAML and JSON
• Ability to write and automate security incident playbooks
• Excellent verbal and written communication skills for incident response reporting
• At least one of the following certifications: CISSP, CEH, GCIH, GCFA, Security+, OSCP
• Security experience with cloud-native environments across operating systems (Unix/Windows), cloud resources (e.g., AWS, GCP, O365), and customer-facing web applications
• Deep knowledge of attacker methodologies and incident response practices