Cyber Security Engineer I

Serve as a member of Sabre's Cyber Incident Response Team (CIRT).

Participate in cybersecurity incident investigations throughout the incident response lifecycle, including identification, analysis, containment, eradication, recovery, and lessons learned.

Perform security investigations independently while collaborating with senior team members on complex or high-severity incidents.

Coordinate with infrastructure, cloud, application, and business teams during incident response activities.

Document investigative findings, evidence, response actions, and remediation recommendations.

Participate in tabletop exercises and post-incident reviews to strengthen organizational preparedness.

Conduct initiative-taking threat hunting activities to identify malicious activity that may evade automated detection.

Analyze endpoint, network, identity, cloud, and security telemetry to identify anomalous or suspicious behavior.

Research emerging cyber threats and assist in translating intelligence into actionable detection content.

Develop and execute threat hunting hypotheses based on current threat intelligence and attack trends.

Create and optimize security detections within SIEM (Cortex XSIAM), endpoint protection, and other security monitoring platforms.

Assist with improving automation and operational efficiency across security processes.

Partner with engineering and infrastructure teams to improve security visibility and telemetry collection.

Contribute to the evaluation and implementation of new security capabilities and technologies.

Partner with Vulnerability Management teams to assess emerging threats and critical vulnerabilities.

Participate in threat-based vulnerability analysis and prioritization activities.

Assist with providing risk-based recommendations to technology teams and system owners.

Communicate technical findings clearly to both technical and non-technical audiences.

Prepare investigation summaries, incident documentation, and after-action reports.

Build productive working relationships with security, infrastructure, cloud, application development, and business teams.

Contribute to team knowledge sharing and continuous improvement initiatives.

Demonstrate professionalism and composure during security incidents and operational escalations.

This position participates in the Cyber Threat Management on-call rotation and is expected to provide support during assigned coverage periods, including after-hours investigation and response activities when necessary. Team members work closely with internal stakeholders and external security partners to ensure timely response to identified threats and security incidents.

We will give careful consideration to your application and review your details against the position criteria. You will receive separate notification as your application progresses.

Please note that only candidates who meet the minimum criteria for the role will proceed in the selection process.