Security Operations Engineer – Incident Response
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Security Operations Engineer leading incident response and forensic investigations at ProCircular. Managing critical security incidents and developing detection methodologies in a SOC environment.
Responsibilities:
- Lead incident response engagements to scope work, perform forensic investigations, contain security incidents, and provide guidance on remediation.
- Serve as the Tier III escalation point for alerts and trouble tickets escalated by Tier I and Tier II analysts that signal an incident requiring advanced review.
- Own the most complex and critical security investigations through to resolution, determining relevancy, urgency, and root cause of escalated alerts and incidents.
- Conduct host forensics, network forensics, log analysis, and malware triage to support incident response investigations.
- Collect and analyze asset data (configurations, running processes, memory, etc.) from affected systems to drive investigation and containment.
- Act as senior first responder to security event escalations via email, phone, and ticket.
- Direct and support Tier I and Tier II analysts in the remediation of critical information security incidents.
- Review and provide quality assurance on trouble tickets and investigative work produced by other team members.
- Monitor advanced security alerts and incidents within established customer Service Level Agreements.
- Craft new detection content and use cases based on threat intelligence, analyst feedback, available log data, and previous incidents.
- Tune rules, filters, and policies for detection-related security technologies to improve accuracy and visibility.
- Build parsers and field extractions to facilitate reliable content development within security data lake architectures.
- Build, implement, and maintain scripts and tools that contribute to ProCircular's security operations and incident response methodologies.
- Design, develop, and maintain security orchestration and automation workflows using industry-leading SOAR platforms.
- Manage, monitor, and maintain assigned security platforms while following and improving established procedures.
- Prepare detailed and accurate reports from analysis outcomes, and write documentation for tasks, procedures, and knowledgebase articles that support the understanding and efficiency of SOC services.
- Mentor junior engineers and analysts, and practice continual self-improvement through education, training, and certification.
- Communicate positively with clients, determine client needs, obtain clarification as required, and escalate issues and messages accordingly.
- Complete assigned projects on time and with excellent quality.
Requirements:
- Prior SOC experience with a focus on detection content development (Splunk, AlienVault, ELK, or similar).
- Strong hands-on experience in threat hunting, incident response, digital forensics, security analysis, and security engineering.
- Strong incident-handling skills across all IR phases of preparation, identification, containment, eradication, recovery, and lessons learned.
- Working knowledge of SOC and detection tooling: EDR, SOAR, SIEM, XDR, network analytics, and intrusion detection.
- Knowledge of core security devices such as firewalls, network- and host-based IDS/IPS, WAF, proxy, AV, and operating system logs, including firewall rule and policy fundamentals.
- Ability to interpret IOCs and a strong understanding of various log formats and source data for security analysis.
- Experience writing suppression and detection rules and developing and maintaining content and reporting.
- Proficiency in one or more programming/scripting languages such as Python, PowerShell, and Bash.
- Experience with Windows and Linux operating systems.
- Experience with network technologies, security and network monitoring tools, packet-capture analysis, and custom intrusion-signature development.
- Deep understanding of networking concepts and a broad range of cyber-attacks.
- Thorough understanding of the latest security principles, techniques, and protocols.
- Experience with internal and client ticketing and knowledgebase systems for incident and problem tracking (e.g., Jira, Confluence).
- Ability to drive process improvements and identify gaps.
- Strong written and oral communication, able to facilitate technical and non-technical conversations and communicate positively with clients, including via phone.
- Natural curiosity to find root cause, and the ability to remain calm under pressure.
- Able to work effectively both independently and in a team; self-motivated, goal- and detail-oriented; flexible and adaptable; able to prioritize multiple tasks and manage time efficiently.
Benefits:
- Flexible on-call coverage, including after-hours and weekends, to support incident response efforts and 24/7/365 security operations.
Similar Jobs
Senior GRC Analyst, SOC 2
Senior GRC Auditor I ensuring client satisfaction through effective IT controls and compliance audits. Develops client relationships while leading external audits to meet industry standards.
Security Operations Engineer
Security Operations Engineer managing security operations and compliance for AI functions in higher education. Ensuring data protection and security in cloud environments and IT operations.
Senior Security Engineer, Incident Response
Senior Security Engineer leading the technical response to incidents and enhancing security processes for Twilio. Working across R&D Engineering and Business teams on security challenges and incident management.
SecOps Transformation Advisor
SecOps Transformation Advisor driving XSIAM revenue and consultative sales strategy for cybersecurity solutions. Engaging executive relationships and providing business value through tailored proposals.
Security Operations Engineer
Security Operations Engineer providing technical and operational support for MDR customers at Vector3. Involved in incident response, troubleshooting, and security initiatives.
Cybersecurity Incident Response Triage Analyst
Cybersecurity Incident Response Triage IR Analyst working with the CIRT team at Accenture Federal Services. Monitoring, analyzing incidents, and developing response strategies to enhance cybersecurity for federal government entities.
Presales Security Architect – SecOps
Presales Security Architect at GuidePoint Security serving as a technical advisor. Leading technical discovery, design, and positioning in cybersecurity across the Northeast region.
Analyst, Security Operations
Analyst in Security Operations at Danaher handling security events, mentoring junior analysts, and developing relationships with Security and IT teams. Reviewing security alerts and improving security posture across a multinational corporation.
Cyber Operations Lead – Incident Response
Cyber Operations Lead responsible for managing cyber incident response operations at Chickasaw Nation Industries. Collaborating with teams to guide investigations and implement security strategies.
Senior SOC Analyst
Analista SOC Sênior responsible for security operations, monitoring, and incident response at a fintech. Collaborating with teams to secure systems and mitigate risks.
External Communications, Operations & Analytics Specialist – Experienced/Senior
Boeing seeks External Communications Specialist to shape communication strategies and engage key media stakeholders. Collaborate across teams to manage communications operations and content strategy.
Cybersecurity Operations Engineer
Cybersecurity Operations Engineer enhancing cybersecurity operations for business customers in Switzerland. Working end-to-end with customers from implementation to operations.
SOC Analyst I
SOC Analyst I monitoring and detecting cybersecurity threats for Apollo Information Systems. Collaborating with the team to protect client networks and systems.
Junior SOC Analyst
SOC Analyst - Level 1 responsible for routine security investigations at Accesa. Combining alert analysis, evidence correlation, and case documentation in a shift-based operations role.
Cybersecurity Operations – Incident Response Lead
Cybersecurity Operations Lead managing 24×7 security operations and incident response for Coastal's hybrid banking environment. Leading detection, response, and vulnerability management to protect businesses and clients.
Senior Security Operations Analyst
Security Operations Analyst monitoring and investigating security threats across enterprise systems. Collaborating with teams on incident response and threat intelligence activities.
Intermediate SecOps Engineer
Intermediate SecOps Engineer at the Eclipse Foundation managing security operations. Focused on threat detection, incident response, and operational resilience across infrastructure.
Staff Security Operations Engineer
Staff Security Operations Engineer enhancing security practices at Apollo. Collaborating with engineering teams to conduct threat modeling and drive secure software development.
SecOps Consultant
Google SecOps Consultant responsible for developing and managing Google SecOps environments. Collaborating with clients and managing services to ensure alignment with business processes.
Associate Cyber Security Operations Analyst
Join S&C Electric as an Associate Cyber Security Operations Analyst. Support cybersecurity initiatives by collaborating with technical teams and developing compliance strategies.