Senior Security Engineer - Blue Team (Remote)

What You Will Do

• Bachelor's degree in Computer Engineering, Electronics Engineering, or equivalent.
• Minimum 4 years of experience in IT Security Architecture & Services.
• Strong knowledge and hands-on experience with security technologies such as WAFs, SIEM, SOAR, EDR, ETP, vulnerability scanning tools, and deception technologies.
• Hands-on experience with one of the SOAR tools (e.g., XSOAR, Resilient) is preferred.
• Strong understanding of network security devices (e.g., firewalls, IPS/IDS).
• Knowledge of Syslog, HTTP, and database log formats.
• Experience with Unix and Windows operating systems.
• Deep understanding of the attack lifecycle and its stages.
• Proficiency in Python or other scripting languages.
• Holding or willing to take the AWS Security Specialist Certificate.
• Preferably holding industry-recognized certificates (e.g., CEH, AWS Sec).
• Splunk Core Certified Power User is a plus.
• Strong analytical, critical thinking, and problem-solving skills.
• Ability to communicate technical details effectively to various stakeholders.
• A proactive, curious mindset with a keen interest in researching emerging cybersecurity threats and trends.

What You Will Need

• Management and Maintenance of SIEM Tools: Configuring, monitoring, and enhancing SIEM functionalities.
• Rule Creation and Optimization: Developing rules, reports, dashboards, and use cases to detect threats and attacks.
• Threat Analysis: Analyzing threats using logs, IPS/IDS, cyber intelligence reports, and other data sources.
• MITRE ATT&CK Framework Integration: Reviewing existing rules and developing new attack detection scenarios.
• Incident Response: Taking an active role in detecting, analyzing, and mitigating security incidents.
• False Positive Reduction: Working with CDC Engineers to optimize detection logic and minimize false positives.
• Log Management: Importing and troubleshooting logs from various security products and company-wide log sources.
• Security Metrics & Reporting: Defining and monitoring key security metrics, creating dashboards and reports.
• Database and EDR Tool Management: Maintaining, optimizing, and enhancing security configurations.
• Cyber Intelligence & Threat Hunting: Staying updated with the latest cyber threats and integrating threat intelligence into security operations.