Security Engineer II

Role & responsibilities

• Your role revolves around investigating Alerts for supported EDR/SIEM tools.
• This involves ensuring that the alerts provide sufficient detail for thorough investigation by our SOC.
• If necessary, you will request the implementation of relevant features from the Engineering/Product Management teams.
• Additionally, you'll be responsible for creating investigation procedure documentation for SOC analysts to aid in their initial investigations.
• This includes conducting training for internal security teams on how to handle alerts and follow investigation procedures effectively.
• You'll also conduct ad-hoc quality assurance checks on Alert quality and their ability to be investigated, particularly during maintenance or when Vendor APIs and Alert Content undergo changes.
• Your primary objective is to guarantee that every Security Alert is easily investigable.
• This involves your capability to construct or modify existing queries to extract additional information that can facilitate alert resolution. Moreover, you possess the ability to write, maintain, and translate threat detection content across various EDR/SIEM platforms.
• In the pursuit of these tasks, you will work collaboratively with a global team, spanning multiple time zones, all within an agile development environment.
• Recognizing when and how to seek assistance is also a crucial aspect of your role.

Preferred candidate profile

• 4+ years of related cybersecurity experience
• Strong familiarity with investigating alerts from security products such as Splunk, Microsoft Sentinel, Devo, Microsoft 365 Defender, Palo Alto Cortex XDR, CrowdStrike, SentinelOne, Carbon Black, and Cylance.
• Exceptional communication skills, both in speaking and writing, with a talent for clear and organized expression.
• Demonstrated ability to quickly acquire new technical concepts and skills.
• Familiarity with tools like Github, Jira, and Confluence
• Certifications like OSCP or CISSP.