Senior Cybersecurity Engineer

About the role

Serve as the technical lead for Security Operations: govern the quality of the MSSP service, respond to complex incidents, and keep the full set of security tools working together effectively.

Key responsibilities

1. MSSP Oversight and Management

• Define and track MSSP SLAs/KPIs (MTTD, MTTR, alert quality, false-positive rate).

• Review incident reports and triage quality weekly/monthly, and attend service review meetings.

• Define use cases, detection rules and playbooks with the MSSP that fit the pharmaceutical business context.

• Make escalation and containment decisions that affect production and warehouse systems.

2. Incident Response and Threat Hunting (Tier 2/3)

• Lead investigations of high-severity incidents, perform root cause analysis and produce post-incident reviews.

• Conduct proactive threat hunting across endpoint, network, cloud and identity, using MITRE ATT&CK as the framework.

• Coordinate initial digital forensics and ensure evidence is collected correctly.

• Run incident response exercises (tabletop / simulation) at least twice a year.

3. Security Architecture and Tooling

• Operate, tune and integrate security tools such as SIEM/SOAR, EDR/XDR, NDR, Firewall/NGFW, Email Security, WAF, Vulnerability Management, PAM and CASB/SASE.

• Evaluate and select new tools (POC, TCO, vendor management) and reduce tool overlap.

• Design security architecture for new projects, including network segmentation between IT and OT/production systems.

4. Vulnerability and Patch Management

• Define the policy and prioritization for vulnerability remediation based on actual risk, in coordination with the infrastructure team and system owners.

• Assess the impact of patches on GxP systems together with QA/Validation before deployment.

5. Knowledge Sharing and Team Support

• Provide technical guidance to GRC and the Data Security Engineer, and support ISO 27001 audits.

• Deliver security awareness activities together with GRC, and mentor junior staff.

Qualifications

• Bachelor's degree or higher in Computer Science, IT, Cybersecurity or a related field.

• At least 5-7 years of experience in Security Operations / Incident Response, including at least 2 years at Tier 2/3 or in a lead role.

• Experience working with an MSSP/SOC (on the provider or the customer side) and understanding of SLA management models.

• In-depth knowledge of at least 3-4 tool categories, with a working understanding of the others.

• Solid understanding of networking, Windows/Linux, Active Directory/Entra ID and cloud (at least one of Azure/AWS/GCP).

• Good English for reading technical documentation and communicating with vendors.

Preferred Certifications: CISSP, GCIH, GCIA, GCFA, CEH/OSCP, CompTIA CySA+/CASP+, vendor certifications for SIEM/EDR in use, cloud security (AZ-500, CCSP). Optional.

Additional Advantages: Experience in regulated industries (pharmaceutical, medical, financial) and an understanding of OT/ICS security.

Expected Skills and Behaviors

• Systems thinking and big-picture view; able to make decisions under pressure.

• Able to communicate with executives and business units in non-technical language.

• Able to negotiate with and hold external service providers accountable in a direct manner.

• Willing to work outside office hours or respond to emergencies under the defined on-call rotation.