Senior Security Engineer

The role

This person will own and improve security operations across corporate IT, cloud, and Kubernetes environments. They will handle security monitoring, detection, incident response, and automation.

What you will do

• Own security monitoring, triage, investigation, and incident response across multiple environments.
• Operate and improve security capabilities across SIEM, EDR, DLP, cloud, network, and identity security.
• Integrate security tools and telemetry into the SOC.
• Build and tune detections, correlation rules, alerts, dashboards, and monitoring use cases.
• Build automated workflows for alert enrichment, triage, investigation, containment, escalation, and response.
• Investigate incidents end-to-end including scoping, evidence collection, root-cause analysis, containment, remediation, and post-incident actions.
• Monitor and investigate GCP and GKE activity.
• Identify gaps and misconfigurations across cloud IAM, Kubernetes RBAC, workloads, containers, secrets, network controls, logging, and security configurations.
• Manage and tune DLP controls and investigate potential data-exfiltration or policy-violation events.
• Investigate phishing and account-compromise activity.

Required qualifications

• 5–7 years of hands-on cybersecurity experience, with strong experience in security operations, security engineering, or incident response.
• Strong hands-on experience with SIEM and EDR, including log analysis, detection development, alert tuning, investigation, and response.
• Experience integrating security technologies and telemetry using APIs, webhooks, scripts, or automation/orchestration platforms.
• Experience building and automating SOC and incident-response workflows.
• Hands-on experience securing and monitoring Google Cloud Platform (GCP).
• Strong understanding of GCP IAM, service accounts, audit logging, VPC networking, storage, KMS, and cloud security controls.
• Hands-on security experience with Kubernetes/GKE, including RBAC, service accounts, namespaces, secrets, network policies, workload security, container security, and audit logging.
• Ability to investigate activity across cloud control-plane, Kubernetes, container/workload, identity, and network telemetry.
• Good understanding of DLP and experience tuning policies and investigating data-security events.
• Strong networking fundamentals, including DNS, HTTP/S, TCP/IP, VPNs, proxies, firewalls, and network traffic analysis.
• Experience investigating phishing, credential compromise, endpoint threats, suspicious network activity, cloud events, and container/Kubernetes security events.
• Understanding of common attacker behaviours and techniques, including privilege escalation, credential abuse, persistence, lateral movement, and data exfiltration.

Nice to have

• Experience building or maturing a SOC/security operations capability in a cloud-first environment.
• Experience with security orchestration and automated response.
• Experience with cloud security posture management, vulnerability management, and container/workload security.
• Experience developing custom detections using telemetry from multiple security and infrastructure sources.
• Familiarity with Infrastructure-as-Code and CI/CD security from an operational security perspective.

About the company

arcanaanalytics