Digital Zone

Senior Security Operations Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnieFull-time

#461101·Dodano 17 dni temu·6

Źródło: Digital Zone

Aplikuj teraz

Tech Stack / Keywords

AWS SIEMEDRCloudTrailGuardDutyVPC Flow LogsKubernetesSOARPython SQL

Podsumowanie oferty

As the first Security Operations hire, you’ll build and run threat detection and incident response for a cloud-native digital goods platform. You’ll own security operations tooling and data pipelines, working with AWS, SIEM, and EDR across cloud, identity, endpoint, and SaaS sources.

Wymagania

Typically 5+ years of experience in security operations, detection engineering, or incident response, with hands-on experience building solutions.
Experience building detections and investigating incidents in AWS, using sources such as CloudTrail, GuardDuty, VPC Flow Logs, and Kubernetes audit logs.
Comfortable leading at least one of the following areas, ideally several:
- Detection engineering and detection-as-code.
- Incident response and cloud forensics.
- SIEM and security data pipeline architecture.
- Security automation (SOAR) and alert triage workflows.
- Threat hunting and threat intelligence.
Able to write code in Python, SQL, or a SIEM query language, treat detections and runbooks like software, and automate repetitive work.
Able to run incidents, keep stakeholders informed, and communicate technical findings as impact and next steps to engineers, leadership, non-technical colleagues, and, when needed, customers.

Nice to Have:

Experience building incident response and logging controls for SOC 2, ISO 27001, or PCI audits.
Experience managing an MDR or MSSP partner.
Familiarity with breach notification obligations, such as UAE PDPL and customer contractual SLAs.
Experience hiring or mentoring security analysts or engineers as a function grows.

Obowiązki

Build and operate security operations across cloud, identity, endpoint, and SaaS, covering threat detection, threat hunting, and incident response.
Design and build security data pipelines that bring logs from cloud, identity, endpoint, and SaaS sources into a SIEM or security data lake; normalize and enrich data at ingestion, monitor pipeline health, and balance coverage against cost and retention requirements.
Select, deploy, configure, and tune SIEM, EDR, cloud threat detection, and automation tooling to improve alert signal-to-noise ratio.
Write detections as code, map them to MITRE ATT&CK, measure and test coverage, and focus effort where risk is highest.
Own the incident response plan and playbooks; act as incident commander for security events and coordinate containment and recovery across engineering, legal, and leadership.
Run blameless post-incident reviews.

Inne informacje

The role is remote and based in Poland.

Digital Zone

2 aktywne oferty

Zobacz wszystkie oferty

Aplikuj teraz