The focus of the Security Operations Engineer is to design and implement automation tools and frameworks for continuous integration and delivery of security tools and platforms. They will also be expected to participate in several different areas within the Security Operations and Incident Response process; these activities can include digital forensics, use case development, security control testing, and further development of pen testing methodologies and tools.
They are responsible for orchestration and automation of various software tools for simplifying tasks. They must also possess the practical experience and technical knowledge of cybersecurity stack, SIEM SOAR, CTI models, common threat tools query language, and frameworks.
The engineer must be able to work independently as well as collaboratively with others, to foster consulting with internal partners on cybersecurity topics and strategic security initiatives.
Key Responsibilities and Accountabilities:
- Develop and deploy application and security components for new SIEM/SOAR/XDR integrations
- Create and maintain ad-hoc application environments for the team
- Work with internal Threat Hunter and Red Teams to setup and maintain Dev/QA and Production environments
- Seek out opportunities to develop and improve existing automation processes
- Monitor the health of the production and QA environments
- Troubleshoot and debug build issues, with a willingness to resolve problems
- Collect and report on operational metrics for SLA reporting and capacity planning
- Analyzing and resolving malfunctions
- Collaborate with other groups by seeking, using, and giving feedback
- May perform other relevant duties as requested.
Educational Background:
- Bachelor’s degree in computer science, Information Security, or a related field.
Technical Skills:
- 2+ years of experience in methodical SOAR or other Orchestration platforms (Required) or
- 3+ years in Software Engineering roles (Desired) in Security related projects
- Broad technical knowledge of current and emerging cybersecurity threats, vulnerabilities, intrusion techniques, and exploit methodologies.
- Self-motivated individual who can drive goals independently and collaborate in a team environment.
- Applicable professional certification
- Prior experience working with in the following areas: (Desired)
- Computer Incident Response Team (CIRT)
- Computer Security Incident Response Center (CSIRC)
- Security Operations Center (SOC)
Soft Skills:
- Excellent communication skills (both written and verbal)
- Strong analytical and problem-solving skills.