Cyber Defense Engineer – SIEM

*USC Preferred

In this position, you will architect, develop and implement advanced technical solutions that empower our cyber defense investigations and incident response team. The ideal candidate will have deep technical expertise in the Microsoft security stack and have demonstrated excellence in the development of security automation across domains such as alert triage, response, as well as other security processes. They will also work extensively with various IT teams to define appropriate log ingestion, data enrichment, alerting and response actions via the SIEM/SOAR platform.

Responsibilities:

• Identifying and deploying new detections or automations within SIEM / SOAR platform.
• Integrating SIEM with other security tools to build a comprehensive security monitoring ecosystem
• Collaborating with cyber defense operations to analyze emerging threats and current gaps in technical capabilities, implementing measures to strengthen defense mechanisms.
• Develop and refine threat defense analytics to effectively detect cyber-attacks against the firm.
• Build task automation and procedure orchestration to support cyber defense operations.
• Design and implementation of automation for alert enrichment, common detections closure, and response actions
• Partnering with various IT organizations to design and implement security monitoring across all core business applications
• Manage and optimize security monitoring and incident response within a Security Operations Center (SOC) environment

Requirements:

• Bachelor’s degree in Computer Science, Information Security, or a related field.
• 3+ years in a security related engineering role
• Demonstrated expertise in security monitoring and SIEM technology
• Deep technical understanding of Microsoft security tooling - Sentinel is a MUST HAVE
• Proficiency with automation tooling and scripting languages (KQL, Python, Powershell)
• Proficiency in API development with the goal of integrating security tooling
• Familiarity with various log ingestion methodologies into a SIEM environment.
• Experience in multi-tenant or MSP like environments a plus
• Highly motivated self-starter who thrives on positively influencing the environment.