Overview
The Security Engineer will serve as a vital technical escalation point for the Security Operations Center (SOC), undertaking complex security incident investigations to drive them towards resolution. This hands-on role involves incident triage, forensic investigation, and threat analysis within a large enterprise environment. The Engineer will work collaboratively with various teams to enhance security measures and improve detection capabilities.
Responsibilities
- Investigate and lead the response to security incidents escalated from the SOC team.
- Perform forensic analysis across endpoints, identities, network, and cloud environments.
- Identify, analyse, and validate indicators of compromise (IoCs) and attacker behaviours.
- Develop and optimise detection logic, correlation rules, and KQL queries.
- Produce clear technical findings, remediation recommendations, and lessons learned.
- Partner with security operations, infrastructure, and application teams to strengthen security controls.
Requirements
- Significant experience in Security Engineering, Incident Response, or Digital Forensics.
- Hands-on experience investigating cyber security incidents in enterprise environments.
- Proven ability to conduct forensic analysis across various technologies.
- Experience identifying IoCs and mapping attacker activity.
- Strong KQL query development skills and experience with SIEM and EDR systems.
- Excellent analytical and communication skills for presenting technical findings.