SME - IT security

Role overview

Key responsibilities

• Design and maintain SIEM use cases, detection rules, correlation logic, dashboards, and monitoring.
• Develop threat detection content using emerging threats, attack techniques, and threat intelligence.
• Automate incident-response workflows with SOAR platforms.
• Integrate cloud, network, endpoint, application, and identity telemetry into centralized monitoring.
• Conduct proactive threat hunting for hidden threats, suspicious behaviors, and indicators of compromise.
• Embed security controls in CI/CD and software delivery processes with DevOps and engineering teams.
• Support investigations, root-cause analysis, and security operations improvements.

Required experience and certifications

• Strong SIEM engineering experience, including log onboarding, detection development, correlation, monitoring, and alert tuning.
• Hands-on detection, response engineering, SOAR automation, threat hunting, and security telemetry experience.
• Knowledge of secure CI/CD, DevSecOps, infrastructure-as-code, and software development lifecycle security.
• Familiarity with scripting languages such as Python or PowerShell and strong cybersecurity fundamentals.
• Required: Microsoft Cybersecurity Architect Expert or equivalent Microsoft Security certification.
• Required: Splunk Core Certified Power User or Splunk Enterprise Security Certified Admin.
• Required: Microsoft SC-200 or equivalent SIEM/SOC-focused certification.
• Required: CompTIA Security+ or equivalent foundational cybersecurity certification.

Additional desirable certifications

• Good to have: GIAC GCIH, GIAC GMON, or CISSP.
• Additional listed credentials include CCSP, CEH or equivalent threat-hunting certification, vendor certifications, and DevSecOps-related certifications.

Role details