By joining our team as a Security Engineer, you will provide support and solutions to a growing team spread around the globe. You will play a key role in supporting security across OneStudyTeam’s applications, infrastructure, endpoints and digital assets. To do so, you will work closely with SRE (DevOps), IT (Corporate), Engineering, Software Development, Product and Data Teams. You will assist with the selection, architecture, and configuration of a next-generation enterprise SIEM and security analytics engine that spans modern infrastructure (AWS), endpoints, and SaaS applications.  You will respond and investigate security events in accordance with OneStudyTeam’s Event and Incident Response policies and processes, modifying them as necessary to meet technological and business needs.

What You’ll Be Working On

• Assist with the selection, architecture, and configuration of a next-generation enterprise SIEM (.e.g., SplunkCloud, SumoLogic, InsightIDR, Exabeam Fusion, Securonix)
• Lead the migration from previous SIEM technology while retaining all capabilities
• Own the configuration and the maintenance of the SIEM following migration
• Champion integration with Application Performance Monitoring solution (Datadog)
• Expand SIEM with a focus on product and application security monitoring and alerting 
• Investigate security events from multiple sources and analyze, triage, document, and escalate security incidents when detected
• Assist with the selection and implementation of advanced corporate security solutions e.g., Endpoint Detection and Response (EDR), Next-Generation Antivirus (NGEP)
• Configure and respond to alerts/events from advanced corporate security solutions
• Participate in product and vendor security assessments as needed

What You’ll Bring to OneStudyTeam

• 2 or more years experience in a dedicated technical information security role is required (e.g., security analyst, security engineer).
• Understanding of modern application stacks including microservice architectures, containerization, CI/CD, and IaC in a cloud environment
• Understanding of logging in cloud environments (e.g. AWS CloudTrail, CloudWatch Log Groups, etc)
• The following experience with a SIEM tool:
  
  • Alert, Dashboard, & Report creation
  • Log formatting, ingestion, & integrations
  • Incident investigation
• Knowledge of modern Identity and Access Management solutions (e.g., OKTA) is a strong plus
• Understanding of OWASP top 10 from both the attack chain and mitigation perspectives is highly desirable.
• Strong understanding of agile SDLC and its related security implications.
• Python experience preferred