L3 Security Operations Specialist (Onsite)

Amaris Consulting | Part of Mantu; Fatih; On-site; TRY 300,000 - 540,000; Full time

Job summary

Amaris Consulting in Turkey is seeking an L3 Security Operations Specialist to join our cybersecurity operations team. You will handle complex escalations related to SIEM, EDR, NDR and XDR platforms, investigate security incidents, troubleshoot product issues and improve detection rules.

The role requires hands-on experience with at least one SIEM (e.g., IBM QRadar, Logsign or Graylog), familiarity with MITRE ATT&CK and Cyber Kill Chain, and strong English communication for documentation and

Qualifications

• 2+ years of experience in cybersecurity operations, SOC, or incident response.
• Hands-on with at least one SIEM such as QRadar, Logsign, or Graylog.
• Experience with EDR, NDR or XDR technologies.
• Knowledge of detection rules, correlation use cases and false positive analysis.
• English reading/writing and ability to read technical docs.

Responsibilities

• Handle L3 escalations related to SIEM, EDR, NDR and XDR platforms.
• Investigate security events and identify root causes.
• Troubleshoot configuration, integration, correlation and alerting issues.
• Create, test and maintain detection rules and use cases.
• Map detection rules to MITRE ATT&CK and Cyber Kill Chain.
• Review false positives and improve alert quality.
• Support Incident Response and DFIR activities.
• Perform threat hunting and document findings.
• Collaborate with SOC, Threat Intelligence, Infra and Security teams.
• Provide guidance to L1/L2 support.

Skills

Cybersecurity operations

SOC

Incident Response

Troubleshooting

Detection rules

MITRE ATT&CK

English communication

Documentation

Root cause analysis

Tools

IBM QRadar

Logsign

Graylog

Cortex XDR

Carbon Black

Microsoft 365 Defender

Vectra

Attivo

SOAR platforms

Fortinet

Cisco Security

Job description

Job Description

We are looking for an L3 Security Operations Specialist to join our cybersecurity operations team. In this role, you will handle complex technical escalations related to SIEM, EDR, NDR and XDR platforms. You will investigate security incidents, troubleshoot product and integration issues, improve detection rules, and support customers and internal teams during critical cases.

Key Responsibilities

• Handle L3 escalations related to SIEM, EDR, NDR and XDR platforms
• Investigate security events and identify the root cause of technical issues
• Troubleshoot product configuration, integration, correlation and alerting problems
• Create, test and maintain detection rules and correlation use cases
• Map detection rules to the MITRE ATT&CK framework and Cyber Kill Chain
• Review false positives and improve alert quality
• Support Incident Response and DFIR activities
• Perform threat hunting and document findings
• Analyse suspicious files, behaviours and malware-related events
• Support security products such as firewalls, WAF, IDS and IPS
• Work with vendors during advanced technical escalations
• Communicate with customers during high-priority incidents
• Prepare root cause analysis documents, technical reports and runbooks
• Work closely with SOC, Threat Intelligence, Infrastructure and Security teams
• Provide technical guidance to L1 and L2 support teams

Requirements

• At least 2 years of experience in cybersecurity operations, SOC, security product support or Incident Response
• Hands-on experience with at least one SIEM platform, such as IBM QRadar, Logsign or Graylog
• Experience with EDR, NDR or XDR technologies
• Experience in security event analysis and incident investigation
• Good knowledge of detection rules, correlation use cases and false positive analysis
• Knowledge of MITRE ATT&CK and Cyber Kill Chain
• Working knowledge of Windows and Linux operating systems
• Knowledge of networking concepts, firewalls, WAF, IDS and IPS
• Experience with customer-facing technical support or escalation management
• Strong documentation and reporting skills
• Ability to analyse complex technical issues and provide clear solutions
• Ability to read technical documentation and communicate in English

Preferred Qualifications

• Experience with Cortex XDR, Carbon Black, Microsoft 365 Defender, Vectra or Attivo
• Experience with SOAR platforms
• Knowledge of malware analysis or digital forensics
• Experience with threat hunting
• Basic scripting knowledge in Python, PowerShell or Bash
• Experience in a 24/7 SOC or shift-based security operation
• Fortinet or Cisco experience
• Relevant certifications such as Fortinet NSE, Cisco Security or other cybersecurity certifications

If you enjoy incident investigation, technical troubleshooting and helping teams respond to real-world threats, we’d like to hear from you.

Amaris Consulting is committed to promoting diversity within its workforce and to creating an inclusive work environment. We review applications from all qualified individuals regardless of gender, sexual orientation, race, ethnicity, beliefs, age, marital status, disability, or any other characteristic. Special consideration will be given to candidates with disabilities.