About the job
Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!
Job Summary: As a Security Operations Engineer, you will be an integral part of Qualys SOC (Security Operation Center) and CSIRT (Cyber Security Incident Response Team) contributing to the day-to-day activities aimed at monitoring, analyzing, and responding to security incidents. This role requires a solid understanding of security technologies, incident response, and a proactive approach to identifying and mitigating potential threats.
Responsibilities:
Security Monitoring and Analysis:
- Monitor security alerts using SIEM tools, analyzing logs, network traffic, and system events to identify potential security incidents.
- Investigate and respond to alerts, ensuring a timely and effective resolution.
Incident Response:
- Participate in incident response activities, assisting in the identification, containment, eradication, and recovery from security incidents.
- Document incident response activities and contribute to post-incident reports.
Threat Intelligence Support:
- Assist in the integration of threat intelligence into security operations processes to enhance detection capabilities.
- Stay informed about the latest cybersecurity threats and vulnerabilities.
Security Infrastructure Support:
- Support the management and optimization of security infrastructure, including intrusion detection/prevention systems, firewalls, and endpoint protection solutions.
- Participate in the configuration and fine-tuning of security technologies.
Automation and Orchestration:
- Contribute to the development and implementation of automation scripts and workflows to streamline repetitive security tasks.
- Collaborate with other teams to integrate security processes into broader IT automation frameworks.
Continuous Improvement:
- Identify areas for improvement in security operations processes and technologies.
- Participate in the implementation of enhancements and optimization of existing security measures.
Collaboration and Communication:
- Collaborate with other security teams, IT teams, and external partners to address security incidents and improve overall security posture.
- Communicate effectively with stakeholders, providing updates on incidents and security operations activities.
Training and Knowledge Sharing:
- Participate in training sessions to enhance skills and knowledge related to security operations.
- Contribute to knowledge-sharing initiatives within the security operations team.
Key Skills:
- Familiarity with security tools, including SIEM solutions, intrusion detection/prevention systems, and endpoint protection.
- Basic understanding and experience in incident response activities.
- Must be familiar will various log sources and investigation approach depending on various kind of incidents. Should understand the correlation between log sources as needed for investigation.
- Analyze network and host activities associated with both successful and unsuccessful intrusions by threat actors basis perimeter security logs.
- Experience in correlating malware infections with attack vectors to determine the extent of security and data compromise.
- Should have worked in third party security monitoring tool to research, document and respond on the security incidents.
- Monitor SIEM and other security tools alerts for anomalous or suspicious activity; research alerts and make recommendations to remediate concerns.
- Analyze, correlate and action on data from subscription and public cyber intelligence services, develop tactics to combat future threats, and follow the Incident Response Plan for required response.
- Awareness of threat intelligence concepts and their relevance to security operations.
- Basic knowledge of scripting (Python, PowerShell, etc.) to support automation efforts.
- Understanding of security infrastructure components and their role in safeguarding the organization
- Strong problem-solving skills to analyze and respond to security incidents effectively.
- Effective communication skills to convey technical information to team members and stakeholders.
- Ability to collaborate with team members and other departments to achieve security goals
Qualifications:
- Bachelor's degree in Computer Science, Information Security, or a related field.
- 2+ years of experience in a security operations role or a related cybersecurity position.
- Understanding of cybersecurity principles and best practices.
- Basic knowledge of networking concepts and protocols.
- Security certifications (e.g., CompTIA Security+, SANS GIAC) are a plus.
- EDR/XDR – Hands on administrating and monitoring any of this product is desirable (Qualys EDR/XDR, Cisco AMP, Carbon Black, Crowdstrike, TrendMicro, Microsoft Sentinel one etc)
- Advanced analytics – UEBA
- Automation - SOAR
- Willingness to pursue additional certifications and training in cybersecurity.
- Strong analytical and problem-solving abilities.
