Tech Stack

Description

You will oversee day-to-day security across endpoints, identity, networks, and cloud, own detection and response workflows, and drive continuous improvement toward a zero-trust approach in a hybrid environment. You'll manage the full incident lifecycle, tune security tools, and partner with cross-functional teams to mature operations.

Requirements

• 8+ years maturing Security Operations into reliable, measurable response capability
• Hands-on with CrowdStrike Falcon, AWS GuardDuty, intrusion prevention tools
• Maintain workflows using ManageEngine for incident tracking
• Calm under pressure; lead investigations resulting in long-term fixes
• Balance high security with business velocity; prioritize automation
• Explain complex security risks to technical and non-technical stakeholders

Responsibilities

• Own full incident lifecycle: intake, classification, escalation, containment, post-incident reviews
• Monitor security signals across AWS, identity providers, and networks; investigate and resolve alerts
• Maintain runbooks, conduct tabletop exercises, reduce MTTD and MTTR
• Tune CrowdStrike Falcon and NG-SIEM; build response playbooks
• Support ISO-27001, UK Cyber Essentials, NIST 800-53 compliance
• Partner with Legal, Finance, IT on vendor security reviews and third-party access governance
• Assist zero-trust architecture transition via identity-first controls, device trust, least privilege
• Participate in on-call rotation for incident response outside business hours