- Company Name
- Perk
- Job Title
- Security Engineer - Security Operations
- Job Description
-
**Job Title:** Security Engineer – Security Operations
**Role Summary:**
Design, implement, and maintain advanced threat detection and response capabilities across SaaS products and cloud infrastructure. Collaborate with engineering, IT, and non‑engineering teams to ensure robust security configurations, continuous monitoring, and compliance with industry standards.
**Expectations:**
- Deliver measurable improvements in threat detection accuracy and response times.
- Stay current on emerging threats, security best practices, and regulatory changes.
- Drive security posture enhancement through automation, standardization, and documentation.
**Key Responsibilities:**
1. Enhance threat detection & response by designing, implementing, and optimizing security tools, detection mechanisms, and secure configurations.
2. Develop, refine, and maintain detection rules, signatures, and IOCs across SIEM, EDR, and other security platforms.
3. Continuously evaluate and upgrade the security technology stack, incorporating new services and threat intelligence feeds.
4. Secure SaaS applications and cloud infrastructure (AWS, GCP) using best practices, access controls, and continuous monitoring (GuardDuty, Security Hub, Inspector, Security Command Center).
5. Implement and enforce governance controls to meet ISO 27001, SOC 2, and PCI‑DSS requirements.
6. Collaborate with cross‑functional teams to integrate security insights into product and project workflows.
7. Conduct threat hunting, incident response, and post‑incident analysis; automate response playbooks where applicable.
8. Document threat detection rules, procedures, and incident reports; maintain knowledge base and playbooks.
**Required Skills:**
- Strong background in security operations and threat detection engineering.
- Hands‑on experience with SIEM (e.g., Splunk, Elastic), EDR, IDS/IPS, and related security tools.
- Proficiency in scripting (Python, Bash) for automation and tool customization.
- Experience with infrastructure‑as‑code (Terraform, Pulumi) and cloud security technologies.
- Deep understanding of networking protocols, attack vectors, and cybersecurity frameworks.
- Analytical problem‑solving with a systematic approach to incident triage and remediation.
- Excellent written and verbal communication to explain technical concepts to non‑technical stakeholders.
- Ability to produce clear, concise documentation of rules, procedures, and incident reports.
- Fluency in English; additional languages preferred.
**Required Education & Certifications:**
- Bachelor’s degree in Computer Science, Information Technology, or related field.
- Relevant certifications (e.g., CISSP, CISM, CEH, or SIEM‑specific certs) are a plus.