Information Security Engineer

Information Security Engineer

Be the spark that brightens days and ignite your career with TTEC’s award-winning employment experience. As a Information Security Engineer working remote in US, you’ll be a part of bringing humanity to business. #experienceTTEC

Our employees have spoken. Our purpose, team, and company culture are amazing and our Great Place to Work® certification in the United States says it all!

What You’ll Do

Investigate security alerts and threat hunting leads across a variety of technologies (SIEM, EDR, email security, cloud, etc) as part of the SOC and with the Threat Management team.

Maintain situational awareness of changes to threat landscape, industry trends, and internal operating environment. You’ll interact frequently with other members of the Information Security teams, internal IT Operations and Engineering teams, and vendor technical resources.

You’ll report to the Information Security Manager. Your role is impactful as it protects TTEC from data loss and security events.

During a Typical Day, You’ll

• Correlate SIEM alerts with endpoint process activity, authentication events, email artifacts, network connections, and cloud audit logs to establish incident timelines, identify affected users and assets, and distinguish benign activity from suspected compromise.

• Spend time understanding the environment you’re responsible for and engage with various teams to gain further knowledge of the environment(s)

• Recognize potential, successful, and unsuccessful intrusion attempts and compromises through review and analysis of relevant event data

• Document incident severity, scope, supporting evidence, investigation steps, and recommended actions in case records. Follow approved response playbooks and escalation procedures, coordinate authorized containment and remediation with system owners, and validate recovery before closing incidents.

• Document incident severity, scope, supporting evidence, investigation steps, and recommended actions in case records. Follow approved response playbooks and escalation procedures, coordinate authorized containment and remediation with system owners, and validate recovery before closing incidents.

What You Bring to the Role

• Hands-on SOC experience investigating and responding to security events across two or more of the following: SIEM, EDR, email security, NGFW, cloud platforms, threat intelligence

• Partner with the Threat Management team to develop, test, and refine detection queries and investigation playbooks.

• Validate detections against relevant event data, investigate false positives, and document telemetry gaps and recommended improvements.

• Ability to investigate cloud security events by reviewing identity and access permissions, administrative activity, audit logs, and network access controls; identify suspicious authentication, privilege changes, and potentially unauthorized access to cloud resources.

• Working knowledge of TCP/IP, DNS, HTTP/S, common network services, Windows and Linux security logs, and authentication and authorization concepts, with the ability to use this knowledge to interpret suspicious host, user, and network activity.

• Strong communication and interpersonal skills

• Preferred:
  Ability to use a scripting language to parse logs, enrich indicators, and automate repetitive investigation tasks, with appropriate validation, error handling, documentation, and protection of sensitive data.

• Candidate will possess 2-3 years of experience in Information Systems or IT security-related functions. IT degree and/ or training is very helpful.

What You Can Expect

• An annual incentive program

• Medical, dental, and vision

• Tax-advantaged health care accounts

• Financial and income protection benefits

• Paid time off (PTO) and wellness time off

• Tuition…