Lead/Principal Cybersecurity Engineer
Summary
Designs, implements, and maintains layered cybersecurity defenses including SIEM, SOAR, EDR, and cloud-native tools while collaborating with IT and risk teams to optimize detection and response.
Position Summary
The Cybersecurity Engineer plays a critical role in helping to design, implement and maintain various security tools that together form a layered defence against cyber threats.
The ideal candidate will work closely with security operations, IT, and risk teams to deploy and optimize security tools, develop policies, and improve detection and response capabilities
Key Responsibilities
- Implement security technologies not limited to SIEM, SOAR, EDR, XDR, Anti-Virus, Vulnerability Management, DLP, PAM, IAM, WAF, IDS/IPS.
- Implement native cloud security solutions and 3rd party security solutions in cloud environments.
- Manage & maintain the security tools ensuring they are hardened as per the security, regulatory and compliance requirements.
- Manage and maintain the technology lifecycle of the solutions to ensure they are running on approved stable versions.
- Manage incidents not limited to zero-day vulnerabilities, patching, misconfigurations with minimal impact to business.
- Troubleshoot implementational issues by working closely with cross functional teams and vendors.
- Perform periodic checks on the solutions to ensure they run optimally and plan for future state considering business growth.
- Conduct comprehensive UAT for the security solutions before rolling out to production environments.
- Partner with vendors to implement security solutions, driving projects from proof-of-concept (POC) to full deployment.
- Implement BAU changes on the tools as part of change management, problem management and incident management, adhering to ITSM processes.
- Continuously update the documentation to ensure the KOPs are available commensurate to daily activities.
Requirements
- Degree in Computer Science, Computer Engineering or Information Security related fields.
- At least 10 years of hands-on experience in managing security tools not limited to SIEM, SOAR, EDR, XDR, Anti-Virus, Vulnerability Management, DLP, PAM, IAM, WAF, IDS/IPS.
- At least 5 years of experience managing native security services in cloud environments not limited to AWS, Azure, OCI, GCP.
- Very good understanding of information security, networking concepts, unix environment and shell scripting with troubleshooting complex issues.
- Experience in planning the implementation and production rollout of security solutions with the ability to manage unforeseen issues.
- Ability to work independently with minimum to no supervision with get things done mindset.
- Candidates must have vendor certification and cloud certifications not limited to AWS Security, MS AZ-500.