Security Operations Engineer

JOB SUMMARY

The Security Engineer is responsible for protecting our organization's networks, systems, and data from evolving threats. In this role, you will design, implement, and operate various security tooling and continuously improve our detections, automation, and defensive posture. The engineer will also be an escalation point for monitoring, detecting, investigating, and responding to cybersecurity threats across the organization's technology environment. The engineer works closely with IT, infrastructure, cloud, and application teams to ensure security is embedded across our infrastructure and operations.

• Monitor, improve, and maintain security events and alerts across the enterprise using SIEM, EDR, and detection telemetry tools; triage and respond to potential incidents in a timely manner.
• Develop and manage detection rules, correlation logic, and automated playbooks (SOAR) to improve response times.
• Analyze and tune security tools to reduce false positives and improve detection fidelity.
• Design, deploy, and maintain security infrastructure, including networking, cloud tooling, endpoint protection, and email security gateways.
• Analyze and triage security alerts to determine legitimacy, severity, and business impact.
• Identify and implement detections for indicators of compromise (IOCs), suspicious behavior, and emerging threats.
• Perform continuous threat monitoring and situational awareness activities.
• Support penetration testing and red team exercises; validate and remediate identified findings.
• Develop and document security operating procedures, runbooks, and incident response plans.
• Stay current on emerging threats, attacker tactics/techniques/procedures (TTPs), and industry best practices (e.g., MITRE ATT&CK).

• Lead or support incident response efforts, including containment, eradication, recovery, and root‑cause analysis.
• Investigate cybersecurity incidents including malware infections, phishing attacks, account compromises, insider threats, and unauthorized access attempts.
• Execute incident response procedures, best practices, and playbooks.
• Document findings, actions taken, and lessons learned for post mortems.
• Escalate significant incidents according to established procedures.
• Perform vulnerability assessments and coordinate remediation with system and application owners.

• Develop and refine detection use cases based on threat intelligence and incident trends.
• Conduct threat hunting activities to proactively identify indicators of compromise and advanced persistent threats.
• Utilize threat intelligence feeds and data analysis to enrich investigations.
• Research emerging threats, vulnerabilities, and attack techniques.

• Assist with security architecture reviews for new systems, applications, and cloud deployments.
• Collaborate with compliance teams to support audits and ensure adherence to relevant frameworks (NIST, ISO 27001, SOC 2, FedRAMP, HITRUST, PCI-DSS, etc.).
• Provide on‑call support for security incidents outside of normal business hours as needed.
• And other duties as assigned.

• Bachelor's degree in computer science, Information Security, or related field, or equivalent practical experience
• 5+ years of experience in cybersecurity operations, security engineering, or a related role
• Strong understanding of networking fundamentals (TCP/IP, DNS, routing, firewalls) and operating systems (Windows, Linux)
• Hands‑on experience managing SIEM platforms (e.g., Splunk, QRadar, Sentinel) and EDR/XDR tools (e.g., Crowd Strike, Sentinel One, Defender)
• Experience with incident response methodologies and digital forensics investigations
• F…