Defender for Cloud Engineer

OpenKyber has a client that is seeking a Senior SOC Analyst in Miami, FL.

Responsibilities:

• Lead investigations of complex, high severity security incidents from detection through containment, remediation, and recovery, coordinating across internal teams and the MDR partner
• Act as the primary escalation point for Tier 3 alerts and incidents and perform root cause analysis with actionable remediation plans
• Serve as the primary liaison to the MDR provider: validate and triage MDR alerts, ensure alignment on response protocols and escalation procedures, and provide tuning recommendations to improve detection fidelity
• Develop and maintain incident response playbooks, runbooks, and workflows
• Analyze threat actor tactics, techniques, and procedures (TTPs) and translate findings into improved defenses and detection content
• Conduct proactive, hypothesis-driven threat hunts across endpoint, identity, network, and cloud telemetry, leveraging threat intelligence and the MITRE ATT&CK framework to surface threats that evade automated detection
• Operationalize hunt findings into durable detection logic and response procedures
• Identify recurring, manual, or manual heavy SOC processes and design automation to reduce analyst effort and accelerate response
• Build, test, and maintain automated playbooks and response workflows in a SOAR platform (e.g., Torq, Microsoft Sentinel Automation Rules and Logic Apps) for enrichment, triage, containment, and case management
• Develop, tune, and operationalize detection and correlation rules through automated validation and deployment
• Measure the impact of automation against SOC performance metrics (MTTD, MTTR, alert volume, false-positive rate) and iterate based on results
• Partner with Detection Engineering and Security Engineering to integrate tooling, close telemetry gaps, and standardize repeatable response

• CompTIA Security+ or equivalent
• Minimum 5-7 years of experience in a cybersecurity operations role, with at least 3 years in a Tier 2/Tier 3 SOC or escalation capacity
• Proven experience leading incident response triage, investigation, and remediation, including working directly with MDR partners
• Experience analyzing cloud security telemetry (e.g., Azure/Entra sign-in logs, AWS CloudTrail)
• Hands-on experience building or maintaining automated playbooks and response workflows in a SOAR platform
• In-depth knowledge of security tools and technologies, including SIEM/SOAR platforms (e.g., Microsoft Sentinel), endpoint detection and response solutions (e.g., Microsoft Defender XDR, Palo Alto Cortex XDR), and ticketing systems (e.g., ServiceNow)
• Strong understanding of network security concepts, operating systems, and malware analysis techniques
• Familiarity with the MITRE ATT&CK framework and threat intelligence platforms
• Excellent analytical, problem-solving, and communication skills, with the ability to work under pressure and manage multiple priorities
• Demonstrated ability to author and tune detection content (e.g., KQL in Sentinel/Defender) and operationalize it into production

• Certifications such as CISSP, GCIA, GCIH, GCFA, CySA+, eJPT/PJPT, CEH, SC-200
• Experience supporting an EDR platform migration (e.g., Cortex XDR to Microsoft Defender XDR)
• Experience with or strong interest in AI-assisted triage and agentic SOC tooling to augment analyst workflows
• Broader cloud security experience across AWS, Azure, and OCI
• Experience with Microsoft Sentinel, Proofpoint, and Palo Alto Cortex XDR
• Scripting and automation skills (Python, PowerShell) for tooling, enrichment, and analysis

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future. We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave. Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in OpenKyber's sole discretion unless and until paid and may be modified in its discretion consistent with the law. This job is not eligible for bonuses, incentives or commissions. OpenKyber is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status. By clicking ?Apply Today? you agree to receive calls, AI-generated calls, text messages or emails from OpenKyber and its affiliates, and service providers. Note that if you choose to communicate with OpenKyber via text messaging the frequency may vary, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You will always have the right to cease communicating via text by using key words such as STOP.

For applications and inquiries, contact:View email address on us.fitly.work