IT Security Operations Engineer

Job Summary

The IT Security Operations Engineer is responsible for monitoring, detecting, analyzing, investigating, and responding to cybersecurity threats and incidents. The role operates within the Security Operations Center (SOC) and focuses on protecting the confidentiality, integrity, and availability of the organization's information systems.

The IT Security Operations Engineer will leverage security technologies, threat intelligence, log analysis, and incident response processes to identify and mitigate security risks while continuously improving SOC detection and response capabilities.

Core Responsibilities

Security Monitoring & Incident Response

• Monitor and analyze alerts from SIEM, EDR/XDR, IDS/IPS, DLP , and other security monitoring platforms.
• Perform triage, investigation, and analysis of security events to identify potential threats and determine their severity and impact.
• Investigate and respond to cybersecurity incidents in accordance with established incident response procedures and SLAs .
• Escalate critical or complex incidents to appropriate teams when required.
• Support containment, eradication, recovery, and root cause analysis (RCA) activities.
• Coordinate with infrastructure, network, application, and other cybersecurity teams during incident investigations.

Threat Detection & Analysis

• Conduct proactive threat hunting using threat intelligence, security telemetry, and log analysis.
• Investigate phishing, malware, ransomware, suspicious activity, and intrusion attempts .
• Analyze security logs and network activity to identify indicators of compromise and abnormal behavior.
• Develop, maintain, and tune detection rules, correlation logic, use cases, and security playbooks .
• Continuously improve detection coverage and reduce false-positive alerts.

Vulnerability & Risk Management

• Support vulnerability scanning, assessment, tracking, and remediation activities.
• Coordinate with IT and infrastructure teams to patch or mitigate identified vulnerabilities and security risks.
• Monitor remediation activities and support closure within agreed timelines.
• Maintain awareness of critical vulnerabilities and emerging cybersecurity threats.
• Support asset inventory management and identify unauthorized or suspicious changes.

Security Tools & Automation

• Manage, monitor, and optimize security technologies such as SIEM, SOAR, EDR/XDR, IDS/IPS, DLP, firewalls, and other SOC tools .
• Support integration of security platforms and log sources into the SOC monitoring environment.
• Develop and maintain automated workflows and SOAR playbooks to improve incident handling and response efficiency.
• Use scripting and automation to support repetitive security operations activities.
• Monitor tool effectiveness and recommend improvements to SOC technologies and processes.

Security Investigation & Analysis

• Perform detailed analysis of security alerts and incidents using log analysis, packet captures, endpoint telemetry, and forensic information .
• Identify attack patterns, indicators of compromise, and potential attack vectors.
• Support investigations involving compromised endpoints, accounts, network activity, and cloud environments.
• Document investigation findings and recommend appropriate remediation actions.

Reporting & Documentation

• Maintain accurate documentation of security incidents, investigations, response actions, RCA findings, and lessons learned .
• Prepare periodic reports covering threat trends, vulnerabilities, incidents, and SOC performance.
• Maintain security operational procedures, incident response playbooks, and technical documentation.
• Support internal and external compliance audits by providing required security logs, reports, and evidence .
• Provide knowledge transfer and technical guidance to junior SOC/security team members.

Technical Expertise

The candidate should have strong hands-on knowledge of:

• SIEM: Splunk, IBM QRadar, Microsoft Sentinel, or equivalent platforms
• Endpoint Security: EDR/XDR and endpoint protection technologies
• Security Monitoring: IDS/IPS, DLP, firewalls, and network security monitoring
• Incident Response: Incident triage, investigation, containment, eradication, recovery, and RCA
• Threat Detection: Threat hunting, detection engineering, correlation rules, and security use cases
• Threat Intelligence: Indicators of compromise, threat feeds, and emerging attack techniques
• Security Automation: SOAR platforms, automated workflows, and security playbooks
• Vulnerability Management: Vulnerability scanning, risk assessment, remediation, and patch coordination
• Operating Systems: Windows and Linux
• Cloud Security: AWS, Microsoft Azure, and GCP environments
• Security Analysis: Log analysis, packet capture, endpoint telemetry, and forensic tools
• Scripting: Python, PowerShell, or Bash for security automation is an advantage
• Cyber Threats: Malware, phishing, ransomware, intrusion techniques, and common attack vectors

Experience & Seniority

• Minimum 5–8 years of relevant experience in SOC operations, cybersecurity, incident response, or IT security operations.
• Strong hands-on experience with SIEM platforms, endpoint security, firewalls, and security monitoring technologies .
• Demonstrated experience investigating and responding to cybersecurity incidents.
• Experience with log analysis, threat hunting, detection tuning, and security incident management.
• Experience working within an SLA-driven SOC environment .
• Ability to work in a 24/7 SOC environment or rotational shifts , where required.