DescriptionThe RoleWe are looking for an
Advanced Monitoring Expert to join our team of cybersecurity analysts. In this role, you will conduct advanced and tailored monitoring activities in post-breach client environments. You will develop detection analyses, triage alerts, investigate security incidents, and perform proactive threat hunting. The role also involves onboarding new clients, working closely with incident response teams, and enhancing visibility and detection capabilities.
This position is ideal for someone who enjoys working in dynamic environments, has strong problem-solving skills, and thrives when collaborating with clients and teammates.
What You'll Do- Perform post-breach monitoring in client environments, including triage of alerts and host forensics analysis.
- Develop custom detection and analysis methods to monitor client environments, often based on known threat actor tactics, techniques, and procedures (TTPs).
- Support major incident response engagements by delivering accurate detection when active threats are suspected.
- Maintain visibility and log forwarding across endpoints, cloud environments, and network devices.
- Conduct proactive threat hunting using host- and network-based analysis, malware hunting, and IOC searches.
- Create automation tools and capabilities for alert triage, escalation, visibility management, and reporting.
- Collaborate with client security teams, providing regular updates and follow-ups on alerts and security events.
- Generate reports and metrics on incidents, trends, visibility status, and response procedures.
RequirementsWhat We're Looking For- 3-5 years of experience in cybersecurity roles within SOC, SecOps, or security monitoring environments.
- Strong analytical thinking and problem-solving skills, with the ability to work independently.
- Strong understanding of the lifecycle of advanced security threats, attack vectors, and exploitation techniques.
- Hands-on experience with SIEM tools such as Splunk, QRadar, ArcSight, or Exabeam.
- Knowledge of common data and log sources for detection and analysis, including Event Logs, Firewalls, and EDR tools.
- Technical understanding of network fundamentals, common Internet protocols, and security controls.
- Familiarity of host-based forensics and OS artifacts.
- Proficiency in scripting languages such as Python.
- Experience with cloud infrastructure, web applications, or servers is a plus.
- Strong customer-facing communication skills.
- Willingness to work outside normal hours and travel occasionally.
Bonus Points For- Experience developing custom detection logic or automation workflows.
- Previous involvement in incident response or digital forensics investigations.
- Familiarity with threat intelligence platforms or red-team engagements.
- Security certifications such as GCIA, GCIH, or OSCP.
