Security Engineer

THE TEAM YOU WILL BE JOININGEstablished enterprise organization continuing to invest in and expand its Information Security functionGrowing security team that is creating clearer specialization across Security Engineering, Security Operations, and Governance, Risk & ComplianceCollaborative environment working alongside internal security engineers and a dedicated 24/7 Security Operations teamOpportunity to join a team that is actively modernizing its security operations capabilities, detection strategy, and automationHighly visible role with direct impact on how the organization detects, investigates, and responds to cybersecurity threatsWHAT THEY OFFER YOUDirect-hire opportunity with a growing Information Security organizationAbility to take meaningful ownership of the organization's SIEM and security operations environmentOpportunity to build and improve detection content rather than simply monitor alertsSignificant exposure to security automation, orchestration, incident response, and threat detectionAbility to influence the future direction of the organization's security technology stackOpportunity to serve as a senior technical resource while partnering with a broader 24/7 SOC operationWHAT YOU WILL DOOwn the day-to-day management, health, tuning, and advancement of the organization's SIEM platformDevelop, tune, and maintain detection rules across identity, endpoint, cloud, network, and other security telemetryServe as a senior escalation resource for complex or high-severity cybersecurity incidentsConduct technical investigations, root-cause analysis, and forensic review as neededDesign and build SOAR playbooks that automate repetitive response activities and improve detection and response timesDevelop automation and enrichment workflows using tools such as PowerShell, Python, or similar scripting languagesEvaluate and onboard new log sources, integrations, data connectors, and threat intelligence feedsPartner with identity, endpoint, infrastructure, and network teams to maintain appropriate security visibilityReview security alerts and identify opportunities to improve detection quality, reduce false positives, and strengthen response processesMaintain documentation for detection logic, incident response procedures, automation, and security operations workflowsProvide technical guidance and mentorship to Tier 1 and Tier 2 security analystsParticipate in incident response activities and an on-call rotation when requiredBACKGROUND PROFILE4+ years of cybersecurity experience with meaningful Security Operations or Incident Response exposure2+ years of hands-on experience working with an enterprise SIEM platformStrong experience developing and tuning SIEM analytics rules, alerts, and detection contentExperience operating as a senior engineer, Tier 3 escalation resource, or advanced SOC analystPractical experience designing or maintaining SOAR playbooksStrong understanding of incident response, investigations, evidence collection, and documentationScripting and automation experience using PowerShell, Python, or similar technologiesExperience integrating technologies such as endpoint security, identity, email security, and network telemetry into a SIEMWorking understanding of the MITRE ATT&CK framework and common threat tactics and techniquesMicrosoft security ecosystem experience is valuable; the current environment includes Microsoft SentinelExposure to tools such as SentinelOne, Red Canary, Proofpoint, or comparable security technologies is beneficialRelevant cybersecurity certification such as Security+, CySA+, GCIH, GCIA, or comparable certification preferredLOCATIONFort Mill, SCOnsiteReference: 70588