Security Engineer

Accountabilities

Security Operations and Incident Response: Investigate and resolve Level 2 and Level 3 security alerts, cases, and incidents using established procedures and playbooks. Gather and validate evidence, assess incident scope and impact, support containment and remediation, and contribute to recovery activities while escalating complex or high-impact situations when necessary.
Detection Engineering: Design, develop, test, deploy, and fine-tune security detections, analytical queries, correlation rules, and incident logic across SIEM, EDR, XDR, cloud, identity, email, and other security platforms. Conduct peer reviews, regression testing, MITRE ATT&CK mapping, and documentation to maintain reliable detection coverage.
Security Automation: Develop and maintain approved automation workflows for enrichment, triage, notifications, containment, and remediation, particularly for repetitive Tier 1 scenarios that external security providers cannot fully address.
Security Platform Engineering: Support the configuration, integration, and troubleshooting of security platforms, including Microsoft Sentinel, Defender XDR, SOAR solutions, telemetry connectors, and case management systems. Investigate data quality issues and improve the reliability of detection rules and automated workflows.
Application Security Monitoring: Monitor security events across SaaS applications, PaaS environments, APIs, web applications, and database services. Develop detections for suspicious application activity, privilege changes, authentication anomalies, API abuse, unauthorized database access, and potential data exfiltration.
Threat Hunting and Analysis: Conduct targeted threat hunts and retrospective investigations using established hypotheses and analytical methods. Document findings and recommend improvements to detection logic, telemetry coverage, and security monitoring practices.
Technical Documentation and Collaboration: Maintain accurate incident records, detection specifications, automation runbooks, and operational procedures. Coordinate technical activities with internal teams and external service providers, communicate progress, and contribute to project milestones and operational objectives.
Continuous Improvement: Identify opportunities to strengthen security controls, reduce recurring escalations, improve incident handling efficiency, and enhance the overall effectiveness of security operations.
Requirements
Education and Experience: A bachelor's degree with at least two years of relevant experience, a master's degree, or a PhD may satisfy the educational requirements. Equivalent knowledge or professional experience may also be considered.
Security Operations Expertise: General knowledge of security operations, incident response, common attacker techniques, incident classification, escalation procedures, containment, remediation, and recovery practices.
Security Technology Experience: Hands-on experience with SIEM, EDR/XDR, SOAR, or comparable security technologies, with the ability to investigate security activity across endpoints, identities, email, cloud, networks, or applications.
Query and Automation Skills: Experience using Kusto Query Language (KQL), Search Processing Language (SPL), SQL, or a comparable query language. Foundational experience with PowerShell, Python, APIs, or similar automation technologies is also required.
Detection and Engineering Practices: Ability to develop and maintain security rules, analytical queries, and workflows while following established engineering standards, peer-review processes, source control practices, testing procedures, and controlled deployment methods.
Analytical and Problem-Solving Skills: Strong investigative judgment and attention to detail, with the ability to validate evidence, determine incident scope, identify suspicious activity, and recommend appropriate response actions.
Communication and Documentation: Ability to document technical findings clearly, maintain accurate case records, communicate status effectively, and make sound escalation decisions when an issue exceeds established authority or expertise.
Time Management and Adaptability: Ability to balance concurrent security incidents and engineering projects, prioritize work effectively, and operate independently under general supervision while seeking guidance when appropriate.
Preferred qualifications:
Practical experience with Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, Microsoft Azure, AWS, or Microsoft 365.
Experience working with outsourced SOC teams, Managed Detection and Response (MDR) providers, Managed Security Service Providers (MSSPs), or managed threat hunting services.
Experience building security detection rules, incident response playbooks, automation workflows, dashboards, response actions, or operational performance metrics.
Relevant industry certifications such as Microsoft SC-200, CompTIA Security+, CySA+, AZ-500, or equivalent credentials.
Benefits
Career development: Opportunities for professional growth and career advancement through structured development initiatives.
Paid time off: Generous paid leave allowances, subject to applicable eligibility and minimum working-hour requirements.
Health and wellness: Competitive benefits package that includes supplementary health and dental insurance.
Employee assistance: Access to an Employee Assistance Program designed to support employee well-being.
Inclusive workplace: Employee resource groups and engagement activities that encourage collaboration, connection, and a sense of belonging.
Community involvement: Volunteer leave opportunities that support charitable activities and community engagement, subject to eligibility requirements.
Meaningful technical impact: The opportunity to strengthen security operations, improve detection capabilities, and contribute to initiatives that protect systems, applications, and sensitive information.