Security Specialist

Responsibilities

• Lead the incident response lifecycle by performing initial triage, detailed analysis of security alerts, and taking actions such as live response, containment, and escalation.
• Serve as an incident coordinator by overseeing security tools, ingesting incident data, tracking incident status, coordinating with internal and external assets, and responding promptly to customer queries and requests related to security events.
• Manage incident handling processes across Windows, Mac, and Linux platforms, ensuring effective containment and remediation.
• Drive efficient process development and documentation for all aspects of the incident response lifecycle.
• Conduct in-depth forensic investigations using industry-standard tools (e.g., Falcon, X-Ways).
• Proactively hunt for threats by analyzing log files, network telemetry, and digital artifacts to detect indicators of compromise within a SIEM platform.
• Perform basic malware analysis to identify and understand malicious activities.
• Develop, refine, and maintain incident response playbooks, runbooks, and technical documentation.
• Integrate threat intelligence with forensic findings to build a comprehensive understanding of emerging attacker tactics and context.
• Collaborate with cross-functional teams, providing mentorship and expert guidance during high-pressure incidents and on-call rotations.
• Participate in on-call rotation support, including weekends, holidays, and after-business hours as required to meet business needs.

Qualifications

• 5+ years of hands-on experience in cybersecurity, incident response, digital forensics, threat hunting, or similar technical roles.
• Experience with endpoint, identity, cloud application, infrastructure, email, network, and other threat detection and prevention technologies, along with a comprehensive background in network, host, and application security.
• Proficiency with SOC workflows, including threat hunting, detection, response, and threat intelligence.
• Strong understanding of Windows, Linux, and Unix operating systems, as well as enterprise technologies (e.g., Active Directory, Entra ID, Okta).
• Experience in network security monitoring, including familiarity with firewalls, proxies, IDS/IPS, SIEMs, and other security monitoring tools.
• Exceptional analytical skills with meticulous attention to detail and an investigative mindset, coupled with a proactive approach to learning and adapting to evolving threats and technologies.
• Strong written and oral communication skills, with fluency in English.
• Willingness to work non-standard hours, including evenings, weekends, and occasional travel.

Preferred Skills

• Experience with cloud forensics and investigating incidents in Azure and AWS cloud platforms.
• Exposure to advanced malware analysis and remediation strategies for targeted attacks.
• Demonstrated ability in scripting or programming (e.g., Python, PowerShell, Bash) for workflow automation and analysis.
• Demonstrated thought leadership through published research, industry presentations, or active community engagement.