Duties & Responsibilities • Lead complex incident investigations, performing deep forensic analysis, root cause determination, and full kill chain reconstruction across endpoint, network, cloud, and identity systems. • Serve as the technical lead for high severity incidents, coordinating containment, eradication, and recovery efforts across cross functional teams. • Develop advanced detection rules, SIEM analytics, EDR custom detections, use cases, and automated response playbooks; tune existing alerts to reduce noise and improve fidelity. • Conduct proactive threat hunting based on threat intelligence, adversary TTPs, anomaly detection, and environmental risk assessments. • Analyze malicious artifacts including scripts, binaries, phishing payloads, and web based attacks using static and dynamic analysis techniques. • Review and advise on network, endpoint, cloud, and identity security architecture to identify gaps and recommend improvements. • Guide and mentor Tier I and Tier II analysts, reviewing investigations, validating escalations, and providing technical training. • Partner with vulnerability management, engineering, cloud, networking, and IAM teams to assess risk, validate findings, and support prioritized remediation. • Produce detailed incident reports, post incident reviews, and recommendations to strengthen organizational resilience and response capability. • Collaborate with security leadership on SOC strategy, tooling enhancements, operational metrics, and continuous improvement initiatives. Requirements Basic Qualifications • Solid understanding of network protocols, data protection mechanisms, and threat landscapes • Hands-on experience with security systems, including firewalls, intrusion detection systems, anti-virus software, etc. Preferred Qualifications • Industry-recognized certifications (e.g., CISSP, CISM, CEH) • Master’s degree in Cybersecurity or a related field