Senior Officer Security Engineering

Skills

About the Role

You lead security engineering activities across threat detection, incident response, managed security operations, defensive hardening, vulnerability testing, threat hunting, and reporting. You operate security monitoring tools, develop detections, manage incident response readiness, coordinate with MSOC providers, investigate attacks, and communicate findings to technical teams and leadership.

Requirements

• 3 to 5 or more years in Security Operations, Blue Team, or Incident Response
• Hands-on experience responding to real-world cyber attacks
• Experience working with or managing Managed Security Operations providers
• Experience designing incident response playbooks and leading VAPT exercises
• Understanding of attack techniques across endpoint, network, identity, and cloud environments
• Familiarity with MITRE ATT&CK
• Hands-on experience with SIEM, EDR/XDR, cloud security telemetry, and vulnerability management
• Scripting or automation skills in Python, Bash, or PowerShell
• Coordination and vendor-management skills
• Technical and executive-level communication skills

Responsibilities

• Operate and improve SIEM, EDR/XDR, and cloud security monitoring
• Develop and tune MITRE ATT&CK-mapped detection use cases
• Lead and support incident response for malware, phishing, account takeover, data exfiltration, ransomware, DDoS, and cloud-native attacks
• Perform root cause analysis and post-incident reviews
• Design and maintain incident response playbooks
• Define triage steps, containment actions, escalation paths, and decision points
• Align playbooks with tooling, internal teams, and MSOC workflows
• Conduct tabletop exercises and simulations
• Lead security engineering alignment with the Managed Security Operations organization
• Ensure monitoring coverage across endpoints, networks, cloud, and identity
• Define alerting thresholds, escalation criteria, and severity definitions
• Maintain communication and escalation channels between the MSOC and cyber defense teams
• Review MSOC detection quality, false positives, and response effectiveness
• Validate MSOC incident handling through drills, VAPT exercises, and real incidents
• Execute endpoint isolation, credential revocation, and network blocking
• Identify defensive gaps and improve logging, alert fidelity, and response workflows
• Investigate suspicious service accounts, API keys, and programmatic access
• Monitor IAM abuse, privilege escalation, and token misuse
• Design and execute VAPT and attack simulations
• Lead external VAPT engagements and track remediation and retesting
• Translate threat intelligence into detections and threat hunts
• Conduct proactive threat hunting
• Produce incident, VAPT, and MSOC performance reports
• Maintain incident metrics, lessons learned, and readiness documentation