Security Engineer

This is a fully remote position, open to applicants in India.

📋 Description

• Investigate and address Level 2 and Level 3 alerts, cases, and incidents by following established procedures, playbooks, and escalation protocols.

• Analyze telemetry from endpoints, identities, emails, cloud services, networks, and applications to confirm activities, assess scope, and document findings.

• Create, test, deploy, optimize, and document detection mechanisms across SIEM, XDR, EDR, cloud, identity, email, and other telemetry sources.

• Formulate approved workflows for enrichment, triage, notifications, containment, and remediation for Tier 1 situations.

• Conduct targeted threat hunts and retrospective searches based on documented hypotheses and established analytical methods.

• Assist with telemetry onboarding, platform configuration, integrations, and troubleshooting efforts.

• Maintain records of cases, detection documentation, automation runbooks, and technical procedures.

• Participate in project milestones and escalate tasks that exceed established authority, procedures, or technical scope.

• Monitor and investigate security events arising from SaaS applications, PaaS platforms, APIs, web applications, and database services.

• Develop application-layer threat detection mechanisms, enrichment logic, and response workflows.

• Provide support for Sentinel, Defender XDR, SOAR, telemetry connectors, case management, and related integrations.

• Coordinate routine technical tasks with internal teams and service providers.

⛳️ Requirements

• General understanding of security operations, incident response, detection engineering, and prevalent attacker techniques.

• Practical experience with SIEM, EDR/XDR, SOAR, or similar security technologies.

• Proficient in utilizing KQL, SPL, SQL, or a comparable query language.

• Foundational knowledge of PowerShell, Python, APIs, or similar automation technologies.

• Capable of clearly documenting technical findings and exercising sound judgment in escalation situations.

• Experience in investigating security activities related to endpoints, identities, emails, clouds, networks, or applications while preserving clear evidence of analysis.

• Working knowledge of incident classification, escalation, containment, remediation, and recovery practices.

• Ability to adhere to established engineering standards, engage in peer review, utilize source control, testing, and controlled deployment processes.

• Proficient in balancing concurrent incidents and engineering tasks, effectively communicating status, and seeking guidance when exceeding scope or authority.

• Bachelor’s degree plus 2 years; Master’s degree plus 0 years; PhD plus 0 years; or equivalent experience.

• Relevant equivalent knowledge or experience may be considered as per FA Technical Leveling definitions.

• Preferred: Practical experience with Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, Azure, AWS, or Microsoft 365.

• Preferred: Experience collaborating with an outsourced SOC, MDR, MSSP, or managed threat hunting provider.

• Preferred: Experience in creating security rules, playbooks, automation workflows, response actions, dashboards, or operational metrics.

• Preferred: Relevant certifications such as SC-200, Security+, CySA+, AZ-500, or equivalent.

🏝️ Benefits

• Equal opportunity employer dedicated to maintaining a workplace and recruitment process free from unlawful discrimination, harassment, and retaliation.

• No recruitment fees are charged to candidates.