Senior Engineer - IT Security

About the role

Lead the design and maintenance of advanced security detection and response frameworks, drive detection engineering, and architect security automation to enhance SOC efficiency.

Key responsibilities

• Design and maintain detection and response frameworks, developing and tuning complex logic in SIEM and XDR platforms.
• Architect security automation by creating end‑to‑end SOAR playbooks that streamline incident‑response workflows.
• Collaborate with Red Teams on Purple‑Team exercises to develop adversary countermeasures and translate offensive findings into automated defensive controls.
• Lead hypothesis‑based threat‑hunting missions to uncover dormant threats that evade signature‑based detection.
• Oversee onboarding of new log sources and ensure SIEM, XDR, and EDR systems are optimized for peak performance.
• Act as the technical escalation point for high‑impact security incidents, conducting deep‑dive forensics and root‑cause analysis.
• Produce technical documentation, detailed reports, and lead lessons‑learned sessions to drive SOC process improvements.
• Work closely with cross‑functional IT and application teams to mitigate identified threats and implement security controls.

Required profile

• Bachelor’s degree in IT, Computer Science, or a Cybersecurity‑related field.
• Professional certifications such as CEH, CHFI, CySA+, CSXP, or SSCP are a plus.
• 3‑5 years of experience in Information Security, with at least 3 years focused on advanced SIEM/XDR administration, detection engineering, or SOC Tier 2/3 roles.
• Proven expertise in architecting and optimizing core Security Operations platforms (SIEM, XDR, SOAR) and developing custom detection logic.
• Strong hands‑on knowledge of Windows and Linux environments and complex network/application protocols (TCP/IP, HTTP, TLS, SSH, DNS).
• Advanced proficiency in scripting (Python, PowerShell, Bash) for security automation and workflow integration.
• Deep expertise with the MITRE ATT&CK framework for detection mapping and MITRE D3FEND for defensive gap analysis.

Required skills

• SIEM platforms
• XDR platforms
• SOAR orchestration
• Detection engineering
• Threat hunting
• Security automation
• Python
• PowerShell
• Bash
• Windows operating systems
• Linux operating systems
• TCP/IP, HTTP, TLS, SSH, DNS protocols
• MITRE ATT&CK framework
• MITRE D3FEND framework
• Log source onboarding
• Incident‑response workflow design
• Forensics and root‑cause analysis