Security Engineer - SecOps

Security Operations Engineer is a technical subject matter expert responsible for executing key functions of CDKs Security Monitoring and Response strategy with an automation first mindset. This individual plays a key technical role in our Security Operations organization and enables effective incident responsevia automated workflows and efficient threat detection content.

Key Responsibilities:

1. Technical Leadership:

• Exemplify security principles and culture

• Develop, implement, and tune automation playbooks that enable incident response

• Effectively partner across security, technology, and business teams

• Provide technical leadership to the security operations team

• Develop effective metrics and use them to drive meaningful improvements

2. Automated Detection & Response

• Work with security operations team members to identify response actions which can be automated to drive efficiency throughout response

• Build automation workflows to contribute to auditable and efficient incident response

• Drive continuous improvement in CDKs detection capability using automation, threat and anomaly detection, coverage assurance, and external threat intelligence

• Build threat detection queries based on attacker techniques and threat intelligence

• Support and tune threat detection content and automation workflows based on metrics and security operations feedback

3. Incident Response:

• Develop incident response playbooks and drive response playbook automation, regularly test playbook effectiveness and drive improvement

• Lead response to medium or highercriticality impact security incidents in accordance with the incident response plan, and effectively coordinate with internal and external parties

• Effectively triage and identify root cause of security alerts and incidents

• Serve as a technical leader for significant security incidents

• Assure 24x7x365 incident response coverage and escalation processes

• Regularly update the list of likely security incident scenarios using external threat intelligence, collaboration with internal technology teams, and other data sources

4. Security Posture Improvement

• Use offensive security techniques and exercises to identifydetection and response gaps and drive remediation

• Regularly practice incident response plans and procedures in collaboration with internal and external stakeholders

Required Qualifications:

Education

• Bachelors degree in computer science, information security, or an equivalent experience

Exper

• Minimum of 6 years in cybersecurity, with at least 3 years in a developer role

• Expert technical expertise in python, javascript, and powershell

• Experience building SOAR workflows

• Experience building and tuning threat detection content

• Experience leading the response to enterprise security alerts and incidents

• Strong background in security monitoring, automation, and incident response, preferably in a complex SaaS environment

• Experience with SIEM tools, process automation, cloud environment monitoring, IDS/IPS, firewalls, EDR solutions, MDR/MSSP providers