SR Security Operations Engineer

Perform proactive threat hunting across endpoint, identity, network, cloud, application, and emerging technology environments to identify malicious activity beyond alert-driven detection.

Leverage threat intelligence, behavioral analytics, telemetry correlation, and adversary tradecraft analysis to identify indicators of compromise (IOCs) and attacker tactics, techniques, and procedures (TTPs).

Investigate sophisticated attack techniques including credential theft, ransomware, insider threats, business email compromise, cloud compromise, and living-off-the-land activity.

Design, develop, tune, validate, and maintain detection content, analytics rules, dashboards, correlation logic, and threat-driven use cases.

Continuously improve detection coverage through threat modeling, attack simulation findings, incident lessons learned, and intelligence-driven prioritization.

Utilize frameworks such as MITRE ATT&CK, NIST 800-61, Cyber Kill Chain, and adversary emulation methodologies to improve detection and response effectiveness.

Identify gaps in telemetry, monitoring coverage, and response capabilities while recommending improvements to increase operational maturity.

Support digital forensic investigations involving enterprise collaboration and communication.

Assist with malware triage, indicator extraction, timeline development, and root cause determination.

Develop investigative methodologies that improve repeatability, consistency, and overall investigative effectiveness.

Lead efforts to enhance and optimize security tools, telemetry pipelines, integrations, and monitoring capabilities.

Support onboarding of new data sources, cloud platforms, applications, and infrastructure services into enterprise security monitoring solutions.

Develop and maintain automation workflows, orchestration capabilities, and machine-driven response processes using SOAR and related technologies.

Leverage scripting, query languages, and security automation techniques to improve detection, investigation, reporting, and operational efficiency.

Utilize artificial intelligence, machine learning technologies, large language models (LLMs), agentic frameworks, and AI-assisted workflows to accelerate investigations and improve analyst effectiveness.

Contribute to secure AI adoption by helping evaluate AI-related risks, controls, governance requirements, and monitoring capabilities.

Identify opportunities to increase operational efficiency through automation, AI augmentation, and process optimization.

Act as a senior resource and mentor for junior and mid-level analysts.

Provide investigative guidance, technical coaching, and peer review of incident investigations and response activities.

Demonstrate ownership and accountability for operational outcomes while consistently contributing to team objectives and strategic initiatives.

Serve as a trusted advisor during major incidents and provide actionable recommendations to leadership.

Lead or participate in tabletop exercises, purple-team engagements, operational readiness testing, and post-incident reviews.

Drive continual improvement of security operations processes, playbooks, detection content, threat hunting methodologies, and incident response procedures.

Maintain a strong commitment to operational excellence, continuous learning, and technical leadership within the team.

Produce high-quality investigation reports, executive summaries, incident briefings, and post-incident analyses.

Communicate technical findings, risk implications, and recommended actions to both technical and executive audiences.

Develop and maintain operational procedures, playbooks, runbooks, standards, and knowledge management documentation.

Contribute to security metrics, reporting, operational dashboards, and program maturity assessments.

#LI-RT1

5+ years of experience in Security Operations, Incident Response, Threat Hunting, Detection Engineering, Digital Forensics, Security Engineering, or a related cybersecurity discipline.

Demonstrated experience leading complex investigations and coordinating response activities for high-priority cybersecurity incidents.

Proven ability to independently manage investigative workstreams and drive incidents through resolution.

Experience mentoring analysts and contributing to operational maturity initiatives.

Strong understanding of cybersecurity operations, threat detection, threat hunting, incident response, security engineering, and digital forensic principles.

Advanced knowledge of networking, operating systems, authentication technologies, cloud computing, enterprise infrastructure, and security controls.

Experience investigating activity across Windows, Linux, macOS, Microsoft 365, Azure, AWS, identity platforms, and cloud-native technologies.

Hands-on experience with SIEM, EDR, SOAR, IAM, DLP, email security, cloud security, vulnerability management, and threat intelligence platforms.

Understanding of malware behavior, forensic artifacts, attack methodologies, post-exploitation techniques, and attacker tradecraft.

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline, or equivalent practical experience.