Responsibilities:
Design, operate, and improve security infrastructure by maintaining core controls, hardening systems, and leading cloud security efforts to address misconfigurations, vulnerabilities, and identity risks.
Monitor, investigate, and remediate security alerts and threats by performing DFIR, analyzing attack vectors, proactively hunting adversary activity, and leading incident response.
Perform security reviews of third-party vendors, SaaS platforms, and internal applications, assessing architectures, data flows, integrations, and risk exposure.
Defend the organization end-to-end across endpoints, identities, applications, and cloud by operating and advancing SecOps controls (SIEM/EDR/CSPM), building automations, enforcing best practices, and partnering cross-functionally to drive security outcomes.
3+ years of hands-on experience in security operations, incident response, or a similar cybersecurity role.
Strong hands-on experience in IT security, endpoint protection, identity security, and general security operations.
Solid understanding of cloud platforms (GCP/AWS/Azure) and practical experience improving cloud security.
Strong knowledge of SIEM technologies (Splunk, ELK) and experience with incident response and DFIR workflows.
Proficiency with Python, Bash, or PowerShell for automation and scripting.
Familiarity with SOAR platforms and building automated playbooks.
Strong communication skills with the ability to collaborate across DevOps, IT, R&D, and business teams.
