Tech Stack
CloudCyber SecuritySplunkSQL
About the role
- Investigate and remediate detections from security tooling across a growing global customer base
- Triage alerts, distinguish false positives from genuine threats, and execute remediation using built-in capabilities and remote PowerShell
- Handle customer queries via the MDR mailbox, assist with user management and investigations
- Monitor detection trends and optimise allow/block listing
- Support onboarding of new customers by guiding tool deployment and contributing to account management
- Engage in proactive threat hunting using threat intelligence data
- Contribute to improving operational processes, people, and technologies and assess new tools
- Create technical resources (e.g., PowerShell scripts) to automate threat identification and remediation
- Mentor team members and share expertise in detection analysis, customer support, and proactive threat hunting
- Share information with other internal teams to support ongoing service improvement
Requirements
- Solid experience in Security Operations (SecOps), particularly in detection and response
- Proven ability to investigate and remediate incidents using EDR/XDR tools
- Working knowledge of log query languages such as SQL, Splunk, or KQL
- Strong grasp of endpoint security, networking protocols, and cloud technologies
- Scripting or programming experience for security tooling and SOAR platforms
- Familiarity with the Mitre ATT&CK framework
- Understanding of Microsoft Windows Active Directory environments
- Established investigation and log analysis skills
- Experience with PowerShell and remote remediation commands
- Experience supporting customers and onboarding security tools