Senior Cyber Threat Defense Security Operations Engineer

What you'll do

• Own Level 3 escalation for high-severity and technically complex security incidents within the global SOC.
• Lead major investigations into malware, ransomware, phishing, identity attacks, and advanced persistent threats.
• Set containment, eradication, and recovery strategies while communicating incident status to executive leadership.
• Proactively hunt for hidden threats across endpoints, networks, cloud environments, and SaaS applications.
• Develop and tune detection rules, hunting queries, and response use cases based on threat intelligence.
• Implement automation strategies for alert enrichment and remediation using SOAR platforms and scripting languages.
• Support Agentic SOC workflows and AI Data Loss Prevention (DLP) controls for generative AI applications.
• Mentor engineers and analysts to establish investigation standards and raise overall technical capability.

What we're looking for

• Eight or more years of hands-on experience in cybersecurity incident response, threat detection, threat hunting, or security operations.
• Demonstrated experience leading major incidents and serving as the final technical escalation point for complex or high-severity security events.
• Strong knowledge of SOC operations, SIEM, SOAR, EDR/XDR, threat intelligence, digital forensics, and security monitoring.
• Experience investigating malware, phishing, identity attacks, cloud compromise, insider threats, data loss, and advanced persistent threats.
• Hands-on experience with SOAR platforms, APIs, and scripting languages such as Python, PowerShell, or Bash.
• Strong understanding of the MITRE ATT&CK framework, attacker tactics, techniques, and procedures, and the cyber kill chain.
• Experience applying threat modeling methods such as STRIDE, attack trees, or MITRE ATT&CK to enterprise or cloud systems.
• U.S. citizenship.