Senior Cybersecurity Engineer

Responsibilities

 

Work AI-enriched alerts, telemetry, and threat feeds to identify and remediate incidents.

Build and maintain agentic tooling and automations across the security stack, automating alert triage, enrichment, and analysis and reducing manual work for the team.

Build and maintain SOAR workflows that integrate SIEM, EDR, identity, email, and ticketing tools to automate enrichment, containment, and case management.

Lead technical investigation, containment, and recovery for security incidents alongside IT, engineering, and business teams, and turn root-cause findings into stronger detections, playbooks, and controls.

Author and tune detections, correlation rules, and queries, drafting them with AI from the threat behaviors you want to catch and validating before they go live.

Prioritize and drive remediation of vulnerability, pentest, and security-assessment findings across the organization.

Routinely assess network and cloud security posture and prioritize gaps against best practices.

Configure and maintain security devices, systems, and tooling according to best practices.

Investigate and respond to phishing reports and quarantine-release requests.

Own and enhance JSSI's Security Awareness Training program.

Design, implement, and operate security improvements across the environment to continually raise the organization's security posture and program maturity.

Establish and report on key security metrics and respond to audit requests and client due-diligence questionnaires.

Document and improve operational procedures, runbooks, and SOPs.

Contribute to incident response planning, security policies, disaster recovery, and business continuity planning.

Collaborate with other IT professionals to advise on cybersecurity best practices.

Participate in the on-call rotation and respond to critical security alerts off-hours.

Perform other duties as assigned.

Requirements

 

Required

7+ years' experience in Information Technology roles, including 4+ years in security operations (SOC analyst, incident response, detection engineering, or similar).

Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent professional experience.

In-depth knowledge of networking protocols and experience configuring network security devices such as firewalls and IDS/IPS.

Experience with EDR and XDR services.

Scripting and query language experience such as Bash, PowerShell, and KQL.

Hands-on experience setting up and querying SIEM tools such as Sumo Logic.

Hands-on experience building automations and playbooks in a SOAR platform, integrating security tooling via APIs to automate triage, enrichment, and response.

Knowledge of data privacy and compliance regulations and cybersecurity frameworks such as ISO 27001 and NIST.

Excellent written and verbal communication skills.

Detail orientation and strong analytical and problem-solving abilities.

Ability to effectively prioritize tasks and projects in a fast-paced environment.

Preferred

Experience with Tines.

Experience with the Microsoft Defender security suite.

Cybersecurity certifications such as CISSP, CISM, or CEH.