This is a fully remote position, open to applicants in United States.

📋 Description

• Evaluate reported incidents, misconfigurations, or detection gaps for authenticity, reproducibility, and feasibility using only the available context.

• Ensure that detection and remediation assessments accurately differentiate between correct solutions and those that are incorrect or incomplete.

• Confirm that embedded forensic artifacts can be reliably recovered through appropriate methodologies.

• Identify inconsistent files, absent context, ambiguous requirements, or uncertainties.

• Provide a concise and clear rationale for each decision made.

• Undertake a paid sample review of a single task, taking approximately 30–45 minutes, prior to commencing regular duties.

⛳️ Requirements

• Practical experience in at least one of the following: SOC/detection engineering, incident response, cloud security (AWS/GCP/Azure IAM and misconfiguration), or digital forensics.

• Proficient in working with logs, cloud consoles/CLIs, and a standard detection-rule language (e.g., Sigma, KQL, or a SIEM's native query language), or established forensic tools.

• Capable of clearly articulating, in writing, the rationale behind whether a finding is realistic and appropriately graded.

• Dependable and self-motivated, comfortable working asynchronously with minimal supervision.

• Possession of a certification such as GCIH, GCFA, GREM, CISSP, or a cloud-security credential (e.g., AWS Security Specialty) is advantageous.

• Experience in developing or refining detection content in a professional capacity is a plus.

• Experience in CTF competitions focusing on forensics or similar categories, or prior blue-team competition experience, is a plus.

• Currently authorized to work in the US.

• Must indicate whether sponsorship will be required in the future.