Tech Stack
AWSAzureCloudCyber SecurityFirewalls
About the role
- Monitor security alerts and events across the enterprise network using traditional tools and AI/ML-powered detection systems.
- Perform triage, investigation, and correlation of security events to determine severity and impact.
- Leverage Google Chronicle for threat intelligence and log analysis to enhance visibility.
- Apply AI and machine learning to identify patterns, anomalies, and behaviors indicative of security incidents.
- Participate in on-call rotations for critical security incidents as needed.
- Investigate and analyze security incidents and breaches; automate initial analysis and support threat hunting.
- Respond to incidents following procedures including containment, eradication, and recovery.
- Conduct root cause analysis and forensic investigations and recommend mitigation strategies.
- Utilize Google SecOps and Chronicle to centralize security data, correlate events, and accelerate response workflows.
- Develop and maintain automated workflows for common security incidents and automate routine SOC tasks.
- Create detailed incident and threat intelligence reports integrating AI-driven findings.
- Prepare regular performance and security posture reports for internal stakeholders.
- Generate and present reports on threat trends and SOC operations; contribute to SOC playbook development.
- Collaborate with cross-functional teams (IT, Customer Success, Engineering, Data Science) to integrate and improve AI-driven security initiatives.
Requirements
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent work experience.
- Relevant certifications (e.g., CISSP, CISM, CEH) are a plus.
- 1+ years of experience in a Security Operations Center (SOC) or a similar security-focused role.
- Hands-on experience with security analytics, log management, threat hunting, and incident response.
- Interest in applying automation and/or artificial intelligence and machine learning techniques to cybersecurity tasks.
- Strong understanding of cybersecurity concepts and frameworks (e.g., NIST, Mitre, ISO, Killl Chain).
- Experience with tools for cybersecurity, such as intrusion detection systems (IDS), SIEM tools, and security automation platforms.
- Knowledge of security technologies such as firewalls, endpoint protection, IDS/IPS, and threat intelligence platforms.
- Strong analytical and problem-solving skills.
- Excellent communication skills for interacting with internal teams and external customers.
- Ability to work under pressure in a fast-paced, dynamic environment.
- Preferred: Experience with security orchestration, automation, and response (SOAR) platforms.
- Preferred: Exposure to cloud security platforms (e.g., AWS, Azure, Google Cloud) and the associated risks.
- Preferred: Practical experience working with Google SecOps tools and Chronicle.
- Preferred: Hands-on experience with the Microsoft security platform (Sentinel, Defender).