AIOPSGROUP Careers

Security Operations

• Lead and coordinate cross-functional teams during severe security breaches, ransomware attacks, or insider threat incidents, ensuring swift containment and effective resolution.
• Design and execute hypothesis-driven threat hunting exercises to uncover hidden threats that evade automated security tools, continuously strengthening the organization's defensive posture.
• Optimize SIEM logic, tune threat intelligence feeds, and develop custom correlation rules and automation playbooks to enhance the accuracy and efficiency of threat detection.
• Conduct in-depth forensic investigations to reconstruct multi-stage intrusions and analyze malicious code, providing actionable insights to prevent future incidents.
• Provide ongoing guidance, coaching, and training to Tier 1 and Tier 2 analysts, fostering a culture of continuous learning and professional development within the security team.

SOC Engineer, L3

QA Automation Engineer

• Build, test, and continuously tune automated playbooks within platforms such as Microsoft Sentinel, Palo Alto XSOAR, or Splunk Phantom to streamline and accelerate security operations.
• Design and implement scripts and connectors utilizing REST APIs, webhooks, and JSON/YAML data structures to seamlessly link SIEMs, EDRs, and ticketing systems into a cohesive security ecosystem.
• Integrate security policies directly into CI/CD pipelines, ensuring that guardrails scale seamlessly alongside infrastructure deployments and maintain consistent security posture across environments.
• Automate threat triaging, data enrichment, and containment measures to dramatically reduce response times for SOC analysts, enabling faster and more effective incident resolution.
• Engineer intelligent automated playbooks that leverage Large Language Models (LLMs) and advanced AI assistance for dynamic alert contextualization and adaptive runtime response pathways.

Security Automation Engineer

• Manage internal Corporate Security posture, monitoring security anomalies, building additional detections and visibility mechanisms, and ensuring the overall security of our internal systems.
• Work closely with various teams to support audits, optimize visibility, and handle security incidents as they arise.
• Act as the primary escalation point for Tier 1 analysts, performing deeper correlation and behavioral analysis on complex, multi-stage security events.
• Coordinate and execute tactical containment actions (e.g., host isolation, credential revocation, network blocks) during active, confirmed security incidents.
• Integrate active cyber threat intelligence (CTI) feeds and Indicators of Compromise (IoCs) into ongoing investigations to identify sophisticated threat actor campaigns.
• Analyze alert queues to identify false-positive trends and collaborate with Tier 3 engineers to recommend precise logic modifications for SIEM correlation rules and EDR policies.
• Author, refine, and maintain Standard Operating Procedures (SOPs) and incident response runbooks to reflect evolving adversary tactics and techniques.
• Maintain accurate records of incidents, investigations, and security-related activities within the incident management platform.
• Create detailed reports on security incidents, response actions taken, and recommendations for improvement.
• Research new concepts and present them to the internal team as well as customers.

SOC Engineer, L3

Security Automation Engineer

Senior SOC Analyst – Microsoft Azure Sentinel