Global Security Operations Engineer

This is a fully remote position, open to applicants in Australia, +1 more country.

📋 Description

• Act as a senior escalation contact for intricate, ambiguous, and high-severity security incidents.

• Carry out comprehensive investigations into initial access vectors, attacker behavior, objectives, the scope of compromise, and dwell time.

• Execute root cause analysis on confirmed incidents and near misses.

• Oversee significant incidents through phases of containment, eradication, and recovery with global and regional teams.

• Conduct host and network forensics along with malware triage.

• Convert technical findings into business risk statements and drive post-incident corrective actions to completion.

• Investigate identity-based assaults, account compromises, unauthorized access, and suspicious activities across cloud platforms and enterprise applications, such as Microsoft 365 and Entra ID.

• Participate in an on-call rotation and provide out-of-hours escalation support.

• Design, build, tune, and maintain MITRE ATT&CK-mapped detection content.

• Minimize false positives through tuning, suppression logic, and automated alert enrichment.

• Transform threat intelligence into detections, threat-hunting hypotheses, and preventive controls.

• Create and uphold automated response playbooks utilizing Logic Apps, automation rules, and SOAR workflows.

• Write and maintain KQL, PowerShell, Python, or equivalent queries, scripts, and code.

• Integrate security tools and data sources through APIs and connectors, including onboarding and validating new log sources.

• Enhance security monitoring, detection, response, automation, and technology optimization.

• Utilize AI-assisted investigation, alert triage, and security automation capabilities.

• Engage in proactive threat hunting to identify suspicious activities and validate detection effectiveness.

• Collaborate closely with global and regional technology and security teams, providing technical leadership during significant incidents.

⛳️ Requirements

• 5+ years of experience in security operations, incident response, or detection engineering, including proven experience in a Security Operations Center (SOC).

• Demonstrated experience leading complex technical investigations from escalation through root cause analysis to documented remediation.

• In-depth, hands-on expertise with modern SIEM and endpoint detection and response (EDR) platforms, including the ability to author and optimize detection logic, conduct investigations, and manage data onboarding.

• Strong practical skills in automation and scripting, including KQL and at least one of PowerShell or Python, with proven experience in developing and operating automation in production environments.

• Experience in designing and maintaining automated response playbooks using Logic Apps, automation rules, or similar SOAR capabilities.

• Advanced knowledge of the MITRE ATT&CK framework, Cyber Kill Chain analysis, and established incident response methodologies, such as PICERL.

• Solid understanding of TCP/IP and networking, Windows and Linux operating systems, Active Directory, Entra cloud identity and authentication, and security operations across cloud and hybrid environments.

• Experience in host and network forensics, malware triage, and the analysis of malicious email headers, links, and attachments.

• Excellent written and verbal communication skills, with the ability to convey technical findings and security risks to both technical and non-technical audiences.

• Ability to work independently and collaborate effectively with geographically dispersed teams, with the flexibility to provide out-of-hours support during significant security incidents.

• Occasional travel may be required to support global cybersecurity operations and incident response.

• Bachelor's degree in Information Security, Information Technology, Computer Science, or a related discipline, or equivalent professional experience (preferred).

• Industry certifications such as GCIH, GCIA, GCFA, GREM, OSCP, CySA+, SC-200, AZ-500, or CISSP (preferred).

• Hands-on experience with Microsoft security technologies, including Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID, and Microsoft Azure (preferred).

• Experience in a global, federated, or shared-services model, ideally in professional services or another highly regulated sector (preferred).

• Familiarity with ISO 27001, the NIST Cybersecurity Framework, or comparable control frameworks (preferred).

🏝️ Benefits

• Benefits are aligned with the respective location.