Senior Information Security Engineer

Responsibilities

Detection Engineering & SIEM Operations

• Design, build, test, and maintain high-fidelity detection logic within the SIEM platform.
• Map detections to the MITRE ATT&CK framework to ensure comprehensive visibility across threat vectors.
• Tune alerts to minimize false positives and reduce alert fatigue.

Automation & Tooling

• Architect and implement automated playbooks within a SOAR platform to reduce mean time to respond (MTTR).
• Develop Python scripts, tools, and integrations using REST APIs to connect security tools and data sources.
• Treat infrastructure and configuration as code to support automated deployments and consistency.

Next-Generation Triage & AI Integration

• Design workflows that use large language models (LLMs) to analyze, summarize, and add context to security alerts.
• Build prompt-engineering pipelines or agentic workflows to assist analysts during investigations and reduce initial triage time.

Incident Response & Cloud Infrastructure

• Serve as a senior escalation point for security incidents, guiding containment, eradication, and recovery.
• Monitor and secure workloads across AWS and on-premises environments.
• Conduct post-incident reviews to identify root causes and create automated preventions and detections.

Requirements

• 8+ years of dedicated experience in information security, security operations, or DevSecOps engineering.
• Hands-on experience with Splunk (SPL, Enterprise Security) or Elastic SIEM (ES|QL, KQL, Kibana) for log analysis and detection creation.
• Strong proficiency in Python and experience building security tools, scripts, and API-based automation pipelines.
• Experience designing and maintaining automated playbooks in a SOAR platform such as Cortex XSOAR or Tines.
• Experience using LLM APIs such as OpenAI, Anthropic, or AWS Bedrock for security-log processing or triage workflows.
• Understanding of AWS security services, including GuardDuty, CloudTrail, IAM, and VPC Flow Logs.
• Familiarity with incident response lifecycles such as NIST SP 800-61 and SANS PICERL.
• Experience as an incident commander or incident handler is strongly desired.

Nice-to-Haves

• CISSP, GCIA, GCIH, or AWS Certified Security - Specialty certification.
• Experience with infrastructure-as-code tools such as Terraform.
• Contributions to the open-source security community, including tools or Sigma rules.