Incident-Response Security Engineer — Tooling & Threat Ops

GXA; Pakistan; On-site; PKR 1,800,000 - 3,200,000; Full time

Job summary

GXA is seeking a highly capable Security Engineer to support the delivery and operation of our gShield security services. This hands-on role focuses on incident response, tool operations, remediation, client security support, and internal security improvements.

The Security Engineer serves as a Tier 3 escalation point for active security incidents and plays a key role in operating and improving the gShield security stack across client environments.

Qualifications

• 5–7+ years of experience in cybersecurity, security operations, security engineering, or incident response roles.
• Strong hands‑on experience with incident response, threat detection, and security operations workflows.
• Experience working with security platforms such as Microsoft Defender, Huntress, DNSFilter, SIEM solutions, vulnerability management tools, and endpoint security technologies.
• Ability to investigate security alerts, analyze logs, trace attacker activity, and support containment and remediation.
• Familiarity with common attack types including phishing, BEC, account compromise, ransomware, and identity‑based attacks.
• Experience supporting security controls in Microsoft 365 and endpoint environments.
• Strong documentation skills and ability to write clear technical procedures and findings.
• Ability to work calmly and methodically during active incidents and escalations.
• Strong collaboration and communication skills with both internal teams and leadership stakeholders.

Responsibilities

• Incident Response: Tier 3 escalation for active security incidents including BEC, AiTM, ransomware, and account compromise.
• Lead technical analysis during incident response and war room events; log review, IOC hunting, lateral movement tracing.
• Execute containment and eradication actions such as endpoint isolation and credential resets.
• Coordinate with SOC teams and vendor threat intelligence during investigations and containment.
• Produce incident timelines, technical findings, and evidence packages for review.

Skills

Incident response

Threat detection

Security operations workflows

Microsoft Defender for Endpoint

Huntress

DNSFilter

SIEM

Vulnerability management tools

Endpoint security technologies

Tools

Intune

AppLocker

ThreatLocker

RMM scripting

Cyrisma

Job description

GXA is seeking a highly capable Security Engineer to support the delivery and operation of our gShield security services. This hands-on role focuses on incident response, tool operations, remediation, client security support, and internal security improvements.

The Security Engineer serves as a Tier 3 escalation point for active security incidents and plays a key role in operating and improving the gShield security stack across client environments.