insiderone - Senior Security Engineer - Blue Team (Remote)

• Bachelor's degree in Computer Engineering, Electronics Engineering, or equivalent. • Minimum 4 years of experience in IT Security Architecture & Services. • Strong knowledge and hands-on experience with security technologies such as WAFs, SIEM, SOAR, EDR, ETP, vulnerability scanning tools, and deception technologies. • Hands-on experience with one of the SOAR tools (e.g., XSOAR, Resilient) is preferred. • Strong understanding of network security devices (e.g., firewalls, IPS/IDS). • Knowledge of Syslog, HTTP, and database log formats. • Experience with Unix and Windows operating systems. • Deep understanding of the attack lifecycle and its stages. • Proficiency in Python or other scripting languages. • Holding or willing to take the AWS Security Specialist Certificate. • Preferably holding industry-recognized certificates (e.g., CEH, AWS Sec). • Splunk Core Certified Power User is a plus. • Strong analytical, critical thinking, and problem-solving skills. • Ability to communicate technical details effectively to various stakeholders. • A proactive, curious mindset with a keen interest in researching emerging cybersecurity threats and trends. • Management and Maintenance of SIEM Tools: Configuring, monitoring, and enhancing SIEM functionalities. • Rule Creation and Optimization: Developing rules, reports, dashboards, and use cases to detect threats and attacks. • Threat Analysis: Analyzing threats using logs, IPS/IDS, cyber intelligence reports, and other data sources. • MITRE ATT&CK Framework Integration: Reviewing existing rules and developing new attack detection scenarios. • Incident Response: Taking an active role in detecting, analyzing, and mitigating security incidents. • False Positive Reduction: Working with CDC Engineers to optimize detection logic and minimize false positives. • Log Management: Importing and troubleshooting logs from various security products and company-wide log sources. • Security Metrics & Reporting: Defining and monitoring key security metrics, creating dashboards and reports. • Database and EDR Tool Management: Maintaining, optimizing, and enhancing security configurations. • Cyber Intelligence & Threat Hunting: Staying updated with the latest cyber threats and integrating threat intelligence into security operations.