Start Date
Immediate
Expiry Date
21 Dec, 26
Salary
65000.0
Posted On
28 Sep, 26
Experience
2 year(s) or above
Remote Job
Yes
Telecommute
Yes
Sponsor Visa
No
Skills
Industry
Information Technology & Services
Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments
Investigate alerts to determine scope, severity, and whether escalation is warranted
Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect
Classify, document, and track alerts through the full lifecycle using ticketing and case management systems
Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication
Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructure
Execute established IR runbooks across identity, endpoint, cloud, and email investigation workflows
Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures
Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences
Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps
Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors
Help maintain and evolve detection coverage mapped to MITRE ATT&CK
Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts
Use AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations
Contribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows
Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort
Partner with engineering teams to improve log ingestion, data quality, and tool integrations
Maintain daily operational notes and shift handoff documentation
Contribute to and refine IR runbooks, playbooks, and standard operating procedures
Participate in on-call rotation for after-hours incident escalation
Track and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunities
Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments
Investigate alerts to determine scope, severity, and whether escalation is warranted
Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect
Classify, document, and track alerts through the full lifecycle using ticketing and case management systems
Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication
Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructure
Execute established IR runbooks across identity, endpoint, cloud, and email investigation workflows
Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures
Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences
Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps
Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors
Help maintain and evolve detection coverage mapped to MITRE ATT&CK
Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts
Use AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations
Contribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows
Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort
Partner with engineering teams to improve log ingestion, data quality, and tool integrations
Maintain daily operational notes and shift handoff documentation
Contribute to and refine IR runbooks, playbooks, and standard operating procedures
Participate in on-call rotation for after-hours incident escalation
Track and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunities
Linked-in
Google