L3 Security Operations Specialist (Onsite)

AMARIS GROUP SA; Fatih; On-site; TRY 180,000 - 300,000; Full time

Job summary

Amaris Consulting is seeking an L3 Security Operations Specialist to join our cybersecurity operations team in Istanbul. You will handle complex escalations, investigate incidents, and improve detection rules while supporting customers and internal teams on critical cases.

The role requires hands-on experience with SIEM platforms and EDR/NDR/XDR technologies, plus strong documentation and communication skills in English.

Qualifications

• 2+ years in cybersecurity operations or incident response.
• Hands-on with at least one SIEM platform (QRadar/Logsign/Graylog).
• Experience with EDR/NDR/XDR technologies.
• Knowledge of MITRE ATT&CK and Cyber Kill Chain is a plus.

Responsibilities

• Handle L3 escalations related to SIEM, EDR, NDR and XDR platforms.
• Investigate security events and identify root causes of technical issues.
• Troubleshoot product configuration, integration, correlation and alerting problems.
• Create, test and maintain detection rules and correlation use cases.
• Map detection rules to the MITRE ATT&CK framework and Cyber Kill Chain.
• Review false positives and improve alert quality.
• Support Incident Response and DFIR activities.
• Perform threat hunting and document findings.
• Analyse suspicious files, behaviours and malware-related events.
• Support security products such as firewalls, WAF, IDS and IPS.
• Work with vendors during advanced technical escalations.
• Communicate with customers during high-priority incidents.
• Prepare root cause analysis documents, technical reports and runbooks.
• Work closely with SOC, Threat Intelligence, Infrastructure and Security teams.
• Provide technical guidance to L1 and L2 support teams.

Skills

Cybersecurity ops

Incident response

English comms

Tools

SIEM tools

Job description

L3 Security Operations Specialist (Onsite)

İstanbul

Permanent Job

Turkish

We are looking for an L3 Security Operations Specialistto join our cybersecurity operations team. In this role, you will handle complex technical escalations related to SIEM, EDR, NDR and XDR platforms. You will investigate security incidents, troubleshoot product and integration issues, improve detection rules, and support customers and internal teams during critical cases.

Key Responsibilities

• Handle L3 escalations related to SIEM, EDR, NDR and XDR platforms
• Investigate security events and identify the root cause of technical issues
• Troubleshoot product configuration, integration, correlation and alerting problems
• Create, test and maintain detection rules and correlation use cases
• Map detection rules to the MITRE ATT&CK framework and Cyber Kill Chain
• Review false positives and improve alert quality
• Support Incident Response and DFIR activities
• Perform threat hunting and document findings
• Analyse suspicious files, behaviours and malware-related events
• Support security products such as firewalls, WAF, IDS and IPS
• Work with vendors during advanced technical escalations
• Communicate with customers during high-priority incidents
• Prepare root cause analysis documents, technical reports and runbooks
• Work closely with SOC, Threat Intelligence, Infrastructure and Security teams
• Provide technical guidance to L1 and L2 support teams

Requirements

• At least 2 years of experience in cybersecurity operations, SOC, security product support or Incident Response
• Hands-on experience with at least one SIEM platform, such as IBM QRadar, Logsign or Graylog
• Experience with EDR, NDR or XDR technologies
• Experience in security event analysis and incident investigation
• Good knowledge of detection rules, correlation use cases and false positive analysis
• Knowledge of MITRE ATT&CK and Cyber Kill Chain
• Working knowledge of Windows and Linux operating systems
• Knowledge of networking concepts, firewalls, WAF, IDS and IPS
• Experience with customer-facing technical support or escalation management
• Strong documentation and reporting skills
• Ability to analyse complex technical issues and provide clear solutions
• Ability to read technical documentation and communicate in English

Preferred Qualifications

• Experience with Cortex XDR, Carbon Black, Microsoft 365 Defender, Vectra or Attivo
• Experience with SOAR platforms
• Knowledge of malware analysis or digital forensics
• Experience with threat hunting
• Basic scripting knowledge in Python, PowerShell or Bash
• Experience in a 24/7 SOC or shift-based security operation
• Fortinet or Cisco experience
• Relevant certifications such as Fortinet NSE, Cisco Security or other cybersecurity certifications

If you enjoy incident investigation, technical troubleshooting and helping teams respond to real-world threats, we’d like to hear from you.

Amaris Consulting is committed to promoting diversity within its workforce and to creating an inclusive work environment. We review applications from all qualified individuals regardless of gender, sexual orientation, race, ethnicity, beliefs, age, marital status, disability, or any other characteristic. Special consideration will be given to candidates with disabilities.

Who are we?

Amaris Consulting isan independent technologyconsulting firm providing guidance and solutions to businesses. With more than 1000 clients across the globe, we have been rolling out solutions in major projects for over a decade – this is made possible by an international team of7,600 people spread across 5 continents and more than 60countries. Our solutions focus on four different Business Lines: Information System & Digital, Telecom, Life Sciences and Engineering. We’re focused on building and nurturing a top talent community where all our team members can achieve their full potential. Amaris is your steppingstone to cross rivers of change, meet challenges and achieve all your projects with success.