Staff Security Operations Engineer

What Success Will Look Like:

1. Security Operations & Threat Detection

• Lead the monitoring, detection, and continuous improvement of security operations across multi-cloud (AWS, Azure, GCP) and hybrid enterprise infrastructure.
• Optimize SIEM and SOAR platforms by creating and tuning custom detection rules, dashboards, and automated response playbooks.
• Proactively conduct threat hunting using threat intelligence feeds, behavioral analytics, and indicators of compromise (IOCs) to identify hidden risks.

2. Incident Response & Digital Forensics

• Serve as the technical lead for high-severity security incidents, managing end-to-end containment, eradication, recovery, and post-incident root-cause analysis (RCA).
• Direct digital forensics and incident response (DFIR) investigations across endpoints, networks, and cloud logs.
• Maintain and conduct periodic tabletop exercises to ensure incident response plans remain updated and effective.

3. Security Automation & Orchestration (DevSecOps Alignment)

• Drive "Security as Code" principles by integrating security controls and continuous automated monitoring into CI/CD pipelines and IaC (Terraform, CloudFormation).
• Develop custom automation scripts (Python, PowerShell, Bash, Go) to streamline repetitive security tasks, reduce false positives, and accelerate MTTR (Mean Time to Respond).

4. Infrastructure & Cloud Security Integration

• Design and enforce security policies for network security, IAM, zero-trust architectures, containerized environments (Kubernetes, Docker), and SaaS applications.
• Conduct regular vulnerability management cycles, prioritizing remediation based on business impact and threat severity.

5. Compliance

• Provide technical guidance to Tier 1/2 SOC analysts and different component SPOCs.
• Collaborate with audit and compliance teams to ensure alignment with security frameworks (ISO 27001, SOC 2, GDPR).
• Prepare executive briefings and operational metrics (e.g., MTTD, MTTR, vulnerability turnaround) for senior leadership.

Who You Are and What You've Done:

1. Required Qualifications & Technical Skills

• Experience: 8–10 years of progressive cybersecurity experience, with at least 5+ years dedicated to Security Operations (SOC), Incident Response, or DevSecOps.
• SIEM & SOAR Expertise: Deep hands-on experience configured, managed, and tuned Enterprise SIEM (Splunk, Microsoft Sentinel, Elastic) and SOAR platforms (Palo Alto XSOAR, Swimlane, Tines).
• Cloud Security: Deep familiarity with securing cloud infrastructure (AWS, Azure, or GCP), cloud-native security tools (GuardDuty, Defender, CloudTrail), and identity controls.
• Scripting & Automation: Strong proficiency in at least one programming/scripting language (Python, PowerShell, Bash, or Go) for automation and API integrations.
• Network & Systems Security: In-depth knowledge of TCP/IP, OSI model, packet analysis (Wireshark), EDR/XDR systems (CrowdStrike, SentinelOne, Defender for Endpoint), and OS security (Linux & Windows).
• Incident Handling: Proven track record leading high-impact security incident investigations under pressure.

2. Preferred Qualifications & Certifications

• Education: Bachelor's or Master’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent experience.
• Certifications (One or more preferred):

• CISSP (Certified Information Systems Security Professional)
• GIAC certifications: GCIH, GCFA, GNFA, or GCDS
• CISM (Certified Information Security Manager)
• Cloud Security Certifications (AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, or CCSP)

• Containers & DevOps: Familiarity with Kubernetes, Docker, CI/CD platforms (GitHub Actions, GitLab CI, Jenkins), and infrastructure-as-code tools.

3. Soft Skills & Attributes

• Problem-Solving: Exceptional analytical and diagnostic skills with an ability to trace complex technical anomalies to their root cause.
• Communication: Ability to articulate complex security risks and incident details clearly to non-technical business leaders and technical teams.
• Crisis Leadership: Calm under pressure during active cyber incidents, with strong decisive leadership abilities.
• Continuous Learning: Passionate about keeping pace with emerging threat landscapes, zero-day vulnerabilities, and defensive technologies.

Learn more atconviva.aiand follow the company onLinkedInandYouTube.