Job Description:
About Organization
Cyber Defense Operations Section operates a 24/7 Security Operations Center (SOC) protecting Rakuten Group's critical infrastructure. We are currently in a critical transformation phase to address the era of autonomous, AI-driven cyber threats. Our mission is to evolve from a reactive monitoring unit into a proactive, intelligence-led, and automated defense organization. We are looking for a highly technical and innovative SOC Analyst (L2) to act as a key architect of our future-ready SOC, leveraging LLMs and AI-powered tools to neutralize advanced adversaries.
Job Duties
- AI-Driven Threat Defense: Utilize LLMs and AI-augmented security platforms to accelerate threat hunting, incident triage, and forensic analysis. Develop workflows to identify and respond to autonomous AI-based attacks.
- SOC Transformation: Actively contribute to the SOC’s capability roadmap. Recommend and implement structural improvements to toolsets and processes to handle the evolving threat landscape.
- Container & K8s Security: Perform deep-dive analysis into containerized environments and Kubernetes clusters. Implement security controls against container-specific exploits and automated lateral movement.
- Capacity Development: Participate in the continuous training and upskilling of the SOC team. Translate technical findings into new playbooks and SOPs to elevate the team's response maturity.
- Advanced Incident Response: Lead the investigation of complex incidents. Apply "Defense in Depth" principles to identify environmental gaps and propose architectural hardening.
- Security Engineering: Collaborate with the L3 Manager to tune detection logic and integrate AI-based feedback loops into our SIEM/SOAR infrastructure.
- Offensive Security Research: Apply an "OffSec" mindset to simulate and test defenses against AI-powered attack tools, ensuring faster and more precise responses.
Minimum Qualifications
- Bachelor’s degree in Computer Science, Cyber Security, or equivalent.
- 5–8 years of experience in a SOC, incident response, or security engineering role.
- Strong understanding of SIEM/SOAR ecosystems and optimization for AI-driven detection.
- Relevant certifications (e.g., GCIH, GCSA, CKAD, CKS, or AI-Security specific certifications).
Preferred Qualifications
- Experience in the Telecommunications sector (e.g., 5G security, NFV, signaling protocols).
- Experience in developing custom AI/ML models or fine-tuning LLMs for security use cases.
- Demonstrable experience in "Red Teaming" or participating in high-level CTF competitions.
- Experience with Infrastructure as Code (IaC) and DevSecOps pipelines.
Work Environment
- Reporting: Reports to the Manager of the Security Operations Center Group.
- Collaboration: Manages/mentors the 24/7 SOC team and collaborates cross-departmentally with other security functions and Business Units.
- Tech Stack: Containerization (Docker/Kubernetes), Telco environments (5G Core, Signaling Protocols), SOAR platforms, Python/Go/Bash, Cloud Security (AWS/Azure/GCP), and LLM-based security tools.
Languages:
English (Overall - 3 - Advanced)
