Incident Responder

Secuwall; Dubai; Presencial; AED 280 000 - 560 000; Tempo integral

Resumo da oferta

Secuwall is seeking a Senior Security Engineer to lead incident response, threat hunting, and automation across hybrid environments. You will build DaC detections, implement AI-assisted security workflows, and drive proactive defense with modern data stacks and SIEM platforms.

The role emphasizes memory forensics, rapid containment, and scalable security automation in AWS/Azure/GCP plus on-premises infrastructure.

Qualificações

• 4+ years in Incident Response, Threat Hunting, or Security Engineering in complex enterprise or MSSP settings.
• Deep knowledge of SIEM/SOC platforms such as Splunk, QRadar, ELK, Google SecOps, or Microsoft Sentinel.
• Hands-on experience with OpenSearch, ClickHouse, Apache Flink, Vector, and DFIR-IRIS.
• Proven ability to perform incident containment using major EDR/XDR, WAFs, and Next-Gen Firewalls.
• Strong programming/scripting skills (Python mandatory; Go, Rust, or Bash a plus).
• Hybrid cloud and on-premise networking expertise (AWS/Azure/GCP, TCP/IP, AD, virtualization).

Responsabilidades

• Lead IR operations across multi-cloud, on-premise, and physical servers with forensics.
• Contain breaches via EDR/XDR, deploy WAF rules, and apply zero-trust blocks.
• Architect automated forensic data collection pipelines and manage incident lifecycles.
• Develop DaC detections, test with Git and CI/CD, and enhance threat hunting.
• Collaborate with AI engineering to automate security workflows.

Conhecimentos

Incident Response

Threat Hunting

Security Engineering

SIEM & SOC Platforms

OpenSearch

ClickHouse

Apache Flink

Vector

DFIR-IRIS

EDR/XDR

WAFs (Cloudflare, F5)

Next-Gen Firewalls

Python

Go/Rust/Bash

Cloud Architecture (AWS/Azure/GCP)

Ferramentas

Splunk

IBM QRadar

ELK Stack

Google SecOps

Microsoft Sentinel

OpenSearch

ClickHouse

Apache Flink

Vector

DFIR-IRIS

Descrição da oferta de emprego

We are seeking a Senior Security Engineer (Incident Response & Threat Hunting) to join our Cyber Defense team.

This role focuses on proactive threat hunting, incident response, security automation, and Detection-as-Code (DaC) across complex hybrid environments spanning AWS, Azure, on-premises infrastructure, and bare-metal systems. You will work closely with our AI Engineering team to advance intelligent, automation-driven security operations while supporting the investigation, containment, and remediation of security incidents.

Core Responsibilities

1. Advanced Incident Response & Active Remediation

• End-to-End IR & Forensics: Lead incident response operations across diverse architectures: Multi-Cloud, on-premise infrastructure, and physical servers. Perform advanced memory forensics, disk imaging, and root-cause analysis.
• Active Containment & Customer Support: Act as the highest technical escalation point to assist customers during active breaches. Execute rapid remediation strategies by isolating compromised hosts via EDR/XDR, deploying custom WAF rules, and implementing zero-trust Firewall blocks.
• Automated Forensics: Architect and deploy automated forensic data collection pipelines in cloud environments and manage incident case lifecycles utilizing platforms like DFIR-IRIS.

2. Threat Hunting, DaC & Platform Engineering

• Proactive Threat Hunting: Execute hypothesis-driven campaigns across petabyte-scale data lakes to uncover advanced persistent threats (APTs) that bypass traditional SIEM solutions.
• Detection Engineering: Translate traditional, static correlation rules into Detection-as-Code (DaC). Write, test, and deploy detections using version control (Git) and CI/CD pipelines.
• Streaming Analytics: Build and optimize high-throughput, stateful detection logic using Apache Flink and modern data routing pipelines.

3. AI-Driven Security & Automation (LLM Integration)

• Automation Development: Write robust scripts and microservices (Python, Go, or Bash) to automate repetitive IR tasks, containment actions, and evidence gathering.
• AI Agent Workflows: Design playbooks, prompt scenarios, and logic flows for AI security assistants (Agents) to accelerate log analysis and automate initial forensic triage.
• Local LLM Training: Collaborate directly with AI Engineers to curate high-quality \"Data Kits\" (sanitized logs, attack payloads, incident timelines). Use these datasets to fine-tune and train our proprietary, air-gapped local LLMs to autonomously detect, triage, and execute Level 1/Level 2 incident response.

Basic Qualifications

• Experience: 4+ years in Incident Response, Threat Hunting, or Security Engineering within complex enterprise or MSSP environments.
• Enterprise SIEM & SOC Platforms: Deep operational knowledge of industry-leading solutions such as Splunk, IBM QRadar, ELK Stack, Google SecOps, or Microsoft Sentinel.
• Modern Data Stack (Alethea Platform ecosystem): Hands-on experience or strong familiarity with high-performance logging, streaming, and forensic architectures including OpenSearch, ClickHouse, Apache Flink, Vector, and DFIR-IRIS.
• Security Stack Expertise: Proven ability to execute incident containment through major EDR/XDR solutions (e.g., CrowdStrike, SentinelOne), WAFs (e.g., Cloudflare, F5), and Next-Gen Firewalls (e.g., Palo Alto, Fortinet).
• Engineering Mindset: Strong programming and scripting skills (Python is mandatory; Go, Rust, or Bash is a plus) with a proven track record of automating security workflows.
• Hybrid Architecture: Deep technical understanding of Cloud architecture (AWS/Azure/GCP) and traditional on-premise/physical server networking (TCP/IP, Active Directory, virtualization).

Preferred Qualifications

• Certifications: Highly regarded industry certifications such as GIAC GCIH, GCFA, GNFA, or offensive certifications (OSCP).
• AI/ML Exposure: Familiarity with Large Language Models (LLMs), Retrieval-Augmented Generation (RAG) concepts, or experience building AI prompts for cybersecurity use cases.
• DevSecOps: Experience with CI/CD pipelines (GitLab, GitHub Actions), containerization (Docker, Kubernetes), and Infrastructure as Code (Terraform).