Senior Cyber Ops Analyst

EPAM Systems, Inc.; Argentina; A distancia; ARS 105.638.000 - 150.912.000; Jornada completa

Descripción de la vacante

EPAM Systems, Inc. is seeking a Senior Cyber Ops Analyst to defend complex environments by owning end-to-end investigations, leading threat hunts, and improving detections and response workflows. You will collaborate across security domains and apply automation to raise team effectiveness.

You will mentor analysts, author and tune detections, and use AI tools to accelerate investigations while validating outputs.

Formación

• 3+ years of SOC or security operations experience owning high-severity investigations.
• Incident response leadership experience coordinating containment and eradication across teams.
• Proven project ownership driving investigations from triage to root-cause analysis and closure.
• Advanced query skills with KQL and SQL for hunting and event correlation.
• Strong scripting skills in Python or PowerShell for automation and integrations.
• Deep SIEM and EDR experience across common enterprise platforms and telemetry sources.
• Strong detection engineering skills authoring, tuning, and validating detection rules.

Responsabilidades

• Own complex multi-signal investigations end-to-end from triage to closure.
• Correlate telemetry across endpoint, identity, network, cloud, and email sources to determine scope and impact.
• Lead incident handling for significant events and coordinate containment and eradication actions.

Conocimientos

SOC experience

Incident response leadership

Threat hunting

KQL

SQL

Python

PowerShell

SIEM

EDR

Detection engineering

Herramientas

CrowdStrike Falcon

Splunk

SOAR

Descripción del empleo

We are looking for a Senior Cyber Ops Analyst to defend complex environments by owning end-to-end investigations, leading threat hunts, and improving detections and response workflows. You will collaborate across security domains and apply automation to raise team effectiveness.ResponsibilitiesOwn complex multi-signal investigations end-to-end from triage to closureCorrelate telemetry across endpoint, identity, network, cloud, and email sources to determine scope and impactDecide on escalation and response actions under ambiguity and justify conclusions with evidenceExecute threat hunts based on threat intelligence and adversary TTPs to uncover missed activityWrite advanced queries to pivot, correlate events, and validate hypotheses across datasetsBuild automation with scripts and APIs to enrich, parse, and correlate investigative dataLead incident handling for significant events and coordinate containment and eradication actionsPartner with detection engineering to translate investigative insights into higher-fidelity detectionsAuthor and tune detection content and track effectiveness and false-positive ratesCreate reusable analytical patterns, runbooks, and hunt guides to improve team executionMentor analysts and raise the team’s investigation and hunting capabilityUse approved AI tools to accelerate investigation workflows while verifying outputsProvide structured input for evaluating security tools and coverage gapsRequirements3+ years of SOC or security operations experience owning high-severity investigationsIncident response leadership experience coordinating containment and eradication across teamsProven project ownership skills driving investigations from triage through root-cause analysis and closureAdvanced query skills with KQL and SQL for hunting and event correlationStrong scripting skills in Python or PowerShell for automation and integrationsDeep SIEM and EDR experience across common enterprise platforms and telemetry sourcesStrong detection engineering skills authoring, tuning, and validating detection rulesSolid log analysis skills across endpoint, identity, network, email, and cloud dataStrong security frameworks knowledge including MITRE ATT&CK and cyber kill chain conceptsStrong cloud fundamentals across AWS, Microsoft Azure, and Google Cloud PlatformStrong communication skills to document findings and defend conclusions with evidenceUpper-Intermediate English proficiency (B2) for clear collaboration and reportingNice to haveCrowdStrike Falcon Platform experienceSplunk experienceSecurity Orchestration and Automated Response experienceDigital forensics experienceWireshark packet analysis skillsWe offerInternational projects with top brandsWork with global teams of highly skilled, diverse peersHealthcare benefitsEmployee financial programsPaid time off and sick leaveUpskilling, reskilling and certification coursesUnlimited access to the LinkedIn Learning library and 22,000+ coursesGlobal career opportunitiesVolunteer and community involvement opportunitiesEPAM Employee GroupsAward-winning culture recognized by Glassdoor, Newsweek and LinkedIn