Blue Team Resource

Job Overview

VaporVM is looking for an experienced Blue Team Resource to strengthen defensive security operations by monitoring, detecting, investigating, and responding to cybersecurity threats. The ideal candidate should have strong hands-on experience in SOC operations, threat detection, incident response, threat hunting, SIEM, EDR/XDR, and security monitoring.

Key Responsibilities

• Monitor and analyze security events across SIEM, EDR/XDR, NDR, firewalls, WAF, IDS/IPS, and other security controls.
• Investigate and respond to security alerts, incidents, and potential threats.
• Perform threat hunting to proactively identify indicators of compromise, suspicious activities, and advanced threats.
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
• Analyze logs, network traffic, endpoint telemetry, and security events to identify malicious activity.
• Develop and optimize detection rules, correlation rules, use cases, dashboards, and alerts.
• Map detected threats and attack techniques to the MITRE ATT&CK framework.
• Perform root cause analysis (RCA) for security incidents and provide recommendations to prevent recurrence.
• Investigate malware, phishing, credential compromise, lateral movement, privilege escalation, and other attack activities.
• Monitor and investigate alerts from EDR/XDR platforms and distinguish false positives from genuine security incidents.
• Collaborate with Red Team, vulnerability management, infrastructure, and application security teams to improve defensive controls.
• Support security incident response exercises and threat simulation activities.
• Maintain detailed documentation of incidents, investigations, findings, and remediation actions.
• Prepare security reports, incident summaries, and operational metrics for technical and management stakeholders.
• Continuously improve SOC processes, detection capabilities, monitoring coverage, and incident response procedures.

Required Skills

• 4–7 years of hands-on experience in Blue Team, SOC, Cyber Defense, Threat Detection, or Incident Response.
• Strong experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or similar.
• Hands-on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike, SentinelOne, or similar.
• Strong understanding of network security, Windows/Linux security, Active Directory, authentication, and enterprise infrastructure.
• Experience with Threat Hunting and Incident Response.
• Strong knowledge of MITRE ATT&CK, Cyber Kill Chain, IOC analysis, TTPs, and detection engineering.
• Experience analyzing Windows Event Logs, Sysmon, firewall logs, DNS, proxy, authentication, and endpoint telemetry.
• Knowledge of network traffic analysis and packet analysis tools such as Wireshark.
• Familiarity with Python, PowerShell, Bash, or other scripting languages is an advantage.
• Strong analytical, troubleshooting, documentation, and communication skills.

Certifications

Relevant certifications are preferred, such as:

• GCIA / GCIH / GCED
• Security+
• CySA+
• SC-200
• BTLO
• CEH
• CISSP
• Other relevant Blue Team, SOC, or Incident Response certifications.

Preferred Profile

A hands-on cybersecurity professional specializing in Blue Team operations, SOC, Threat Hunting, Incident Response, SIEM, EDR/XDR, and Detection Engineering, with the ability to investigate sophisticated threats and continuously strengthen an organization’s defensive security posture.