Position Summary

The Senior IT Security Operations Engineer is responsible for monitoring, detecting, analyzing, and responding to cybersecurity threats and incidents. This role works within the Security Operations Center (SOC) to ensure the confidentiality, integrity, and availability of the organization’s information systems by leveraging security tools, conducting investigations, and supporting incident response.

Key Responsibilities

1. Security Monitoring & Incident Response

· Monitor SIEM, EDR, IDS/IPS, DLP, and other security tools for alerts and anomalies.

· Perform triage, investigation, and analysis of security events to identify potential threats.

· Escalate incidents as needed and support root cause analysis.

· Assist in containment, eradication, and recovery during security incidents.

2. Threat Detection & Analysis

· Conduct threat hunting activities using threat intelligence and log analysis.

· Investigate phishing, malware, and intrusion attempts.

· Maintain and tune detection rules, correlation logic, and playbooks.

3. Vulnerability & Risk Management

· Support vulnerability scanning and remediation efforts.

· Work with IT teams to patch and mitigate identified risks.

· Maintain asset inventories and monitor for unauthorized changes.

4. Security Tools & Automation

· Manage and optimize security monitoring tools (SIEM, SOAR, EDR, etc.).

· Develop automation scripts and playbooks for faster incident handling.

· Provide feedback to improve SOC processes and tool effectiveness.

5. Reporting & Documentation

· Document incidents, investigations, and lessons learned.

· Generate periodic reports on threat trends, vulnerabilities, and SOC performance.

· Assist in compliance audits by providing evidence and logs.

—

Qualifications & Skills

Education & Certifications

· Bachelor’s degree in Computer Science, Information Security, or related field.

· Security certifications (CompTIA Security+, CEH, Splunk Certified, GIAC GCIA/GCED, OSCP, or similar).

Experience

· 5–8 years of experience in SOC, cybersecurity, or IT security operations.

· Hands-on experience with SIEM platforms (Splunk, QRadar, Sentinel), firewalls, and endpoint security.

· Familiarity with log analysis, packet capture, and forensic tools.

Technical Skills

· Knowledge of Windows, Linux, and cloud environments (AWS, Azure, GCP).

· Understanding of malware, phishing, ransomware, and intrusion techniques.

· Scripting skills (Python, PowerShell, Bash) a plus for automation.

Soft Skills

· Strong analytical and problem-solving skills.

· Ability to work in a 24/7 SOC environment (shift rotation if required).

· Good communication skills for incident reporting and cross-team collaboration.

Key Performance Indicators (KPIs)

· Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).

· Number of false positives reduced via tuning.

· Percentage of incidents investigated and closed within SLA.

· Contribution to improved detection coverage and automation.