Security Monitoring & Incident Response:
- Monitor and triage alerts across identity, endpoint, email, network, cloud, and application security technologies.
- Validate, enrich, and investigate security events including phishing, account compromise, malware, and unauthorized access.
- Collect and preserve evidence, coordinate containment actions, and support eradication and recovery validation.
Threat Intelligence & Vulnerability Management:
- Collect and evaluate threat intelligence from commercial, government, industry, and internal sources.
- Conduct hypothesis-driven threat hunting using MITRE ATT&CK and document findings.
- Validate and prioritize vulnerabilities based on threat intelligence and incident telemetry, coordinating remediation with asset owners.
Qualifications & Skills:
- 3+ years of experience in cybersecurity operations, incident response, or related IT/security fields.
- Experience with SIEM, EDR/XDR, identity, email, cloud, and network security tools.
- Relevant certifications such as Security+, CySA+, SC-200, GCIH, or GCIA are preferred.