Scope of Work

You’ll own outcomes across Security Operations with focus on four areas:

• Threat Detection & Response — SIEM optimisation, EDR/XDR tuning, incident investigation, threat hunting
• AI-Driven Defence — Anomaly detection models, UEBA, automated triage, phishing detection pipelines
• Security Hardening — Cloud security posture (AWS, GCP, Azure), WAF/CDN configuration, SSO and IAM policy enforcement
• Cross-functional Security — Integrating controls into engineering workflows, CI/CD pipelines, and DevOps processes
• 
  

What You’ll Do

Detect and Hunt

• Build detection logic that fires early: Extend SIEM custom rules, AI-powered anomaly baselines, and automated alert enrichment that reduce noise and surface what matters.
• Run threat hunts with hypotheses, not hunches: Use behavioural analytics, log forensics, and threat intelligence to surface adversarial activity hiding below the alert threshold.
• Tune signal, not noise: Optimise EDR/XDR configurations to cut false positives and make attack visibility actionable — not overwhelming.

Automate the Response

• Replace manual triage with intelligent playbooks: Build incident response automation that contains threats in minutes, not hours.
• Encode institutional knowledge into systems: When a senior analyst’s six-step response becomes a runbook, you turn it into a workflow that runs at 3am without them.