Tech Stack
AWSAzureCloudCyber SecurityFirewallsPython
About the role
- Monitor security alerts and events across the enterprise network using traditional tools and AI/ML-powered threat detection systems.
- Perform triage, investigation, and correlation of security events to determine severity and impact.
- Leverage Google Chronicle for threat intelligence, log analysis, and to enhance visibility into security incidents.
- Apply AI/ML to identify patterns, anomalies, and behaviors indicative of security incidents to reduce false positives and improve detection.
- Participate in on-call rotations and team scheduling for critical security incidents.
- Investigate and analyze security incidents and breaches; respond with containment, eradication, and recovery actions.
- Conduct root cause analysis and forensic investigations and recommend mitigation strategies.
- Integrate and optimize Google SecOps and Chronicle within the SOC to centralize security data and accelerate incident response.
- Develop and maintain automated workflows for common security incidents leveraging AI for decision-making and faster response.
- Automate routine SOC tasks such as log analysis, incident classification, and threat intelligence enrichment.
- Create detailed incident reports and threat intelligence summaries with AI-driven findings.
- Prepare regular performance and security posture reports for internal stakeholders and customers.
- Provide recommendations for security improvements and contribute to SOC playbook development.
- Collaborate with IT, Security, Data Science, Customer Success, and Engineering to integrate AI-driven security initiatives and share knowledge.
Requirements
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent work experience.
- Relevant certifications (e.g., CISSP, CISM, CEH) are a plus.
- 4+ years of experience in a Security Operations Center (SOC) or a similar security-focused role.
- Hands-on experience with security analytics, log management, threat hunting, and incident response.
- Interest in applying automation and/or artificial intelligence and machine learning techniques to cybersecurity tasks.
- Strong understanding of cybersecurity concepts and frameworks (e.g., NIST, Mitre, ISO, Killl Chain).
- Experience with tools for cybersecurity, such as intrusion detection systems (IDS), SIEM tools, and security automation platforms.
- Proficiency in scripting languages (e.g., Python, PowerShell) for automation and integration.
- Knowledge of security technologies such as firewalls, endpoint protection, IDS/IPS, and threat intelligence platforms.
- Strong analytical and problem-solving skills.
- Excellent communication skills for interacting with internal teams and external customers.
- Ability to work under pressure in a fast-paced, dynamic environment.
- Preferred: Experience with security orchestration, automation, and response (SOAR) platforms.
- Preferred: Exposure to cloud security platforms (e.g., AWS, Azure, Google Cloud) and the associated risks.
- Preferred: Practical experience working with Google SecOps tools and Chronicle for centralized threat intelligence and event correlation.
- Preferred: Hands-on experience with the Microsoft security platform (Sentinel, Defender) is a plus.
- Must live in or be able to commute to the Kansas City metro for this role.