Senior Information Security Specialist

WE Soda; Çankaya; On-site; TRY 600,000 - 900,000; Full time

Job summary

WE Soda in Türkiye seeks a hands-on Senior Security Specialist to drive incidents from detection to resolution. You will coordinate with MSSP/SOC, Group IT, Türkiye IT, and external providers to validate alerts and document outcomes.

The role requires strong expertise in LogRhythm SIEM, EDR tools, and Windows security fundamentals, with experience across international teams and email security tooling.

Qualifications

• 5+ years in Security Operations, SOC, Incident Response, or Cybersecurity Operations.
• 3+ years hands-on experience investigating cybersecurity incidents.
• Direct MSSP/SOC experience.
• Hands-on with LogRhythm SIEM.
• Experience with EDR tools (e.g., SentinelOne, Defender for Endpoint, CrowdStrike).
• Solid understanding of Microsoft 365 security, Entra ID, MFA and sign-in log analysis.
• Experience with phishing and email security events (Proofpoint, Defender for Office 365, Mimecast).
• Knowledge of Windows endpoints, AD, PowerShell basics, logs and network security fundamentals.
• Familiarity with ITSM tools (4me/Xurrent, ServiceNow, Jira).
• Experience working across international teams and time zones.

Responsibilities

• Act as the main liaison for MSSP/SOC escalations.
• Review, validate, and challenge security alerts and investigations.
• Coordinate incident responses including phishing, malware, ransomware, and data leakage.
• Lead containment actions (isolation, MFA review, access revocation).
• Use LogRhythm SIEM for alarm review, evidence validation, and tuning.
• Work with EDR, MS 365/Entra ID, email security tools.
• Maintain audit-ready incident records in 4me/Xurrent.
• Support SOC improvement and incident response processes.
• Lead or participate in multi-region incident calls.

Skills

Security operations

Incident response

Stakeholder communication

Cross-region coordination

Analytical thinking

Tools

LogRhythm SIEM

SentinelOne

Microsoft Defender for Endpoint

Proofpoint

Defender for Office 365

Mimecast

Job description

We are seeking a hands‑on Senior Security Specialist to act as the primary internal liaison with our MSSP/SOC, driving cybersecurity incidents from detection through to resolution.

This role will work closely with Group IT, Türkiye IT, US IT, and external security providers to validate alerts, challenge incomplete investigations, coordinate containment and remediation actions, and ensure incidents are properly documented and closed.

They must be able to make sound operational decisions during live security events, communicate clearly with technical and non-technical stakeholders, and convert MSSP/SOC escalations into real internal action.

Key Responsibilities

• Act as the main point of contact for MSSP/SOC escalations.
• Review, validate, and challenge security alerts and investigations.
• Coordinate response to incidents including phishing, malware, ransomware, account compromise, data leakage, insider risk, and third‑party security events.
• Drive containment actions such as endpoint isolation, account disablement, MFA review, email purge, access revocation, and escalation to IT teams.
• Use LogRhythm SIEM for alarm review, log searches, evidence validation, case support, correlation rules, reporting, and detection tuning.
• Work with EDR, Microsoft 365 / Entra ID, email security, identity, endpoint, and network security tools.
• Maintain clear, audit‑ready incident records in 4me/Xurrent, including timelines, evidence, actions, decisions, and post‑incident reviews.
• Support improvement of SOC performance, detection use cases, SIEM tuning, and incident response processes.
• Lead or participate in incident calls across different regions and time zones.

Required Experience and Skills

• Minimum 5 years’ experience in Security Operations, SOC, Incident Response, or Cybersecurity Operations.
• Minimum 3 years’ hands‑on experience investigating and responding to cybersecurity incidents.
• Direct experience working with, or within, an MSSP/SOC environment.
• Hands‑on experience with LogRhythm SIEM.
• Experience with EDR tools such as SentinelOne, Microsoft Defender for Endpoint, CrowdStrike, or similar.
• Good understanding of Microsoft 365 security, Entra ID, MFA, conditional access, and sign‑in log analysis.
• Experience investigating phishing and email security events using Proofpoint, Defender for Office 365, Mimecast, or similar.
• Good understanding of Windows endpoints, Active Directory, PowerShell basics, firewall logs, VPN logs, DNS, proxy logs, and network security fundamentals.
• Experience using ITSM tools such as 4me/Xurrent, ServiceNow, Jira Service Management, or similar.
• Experience working across international teams and multiple time zones is strongly preferred.
• Exposure to industrial, manufacturing, mining, chemicals, or OT/ICS environments would be advantageous.

Certifications

At least one relevant cybersecurity certification is required, such as:

• GCIH
• CompTIA CySA+
• Microsoft SC‑200
• Microsoft AZ‑500
• CompTIA Security+
• SSCP
• CISSP or CISM, where supported by hands‑on SecOps or Incident Response experience

Additional certifications such as GCIA, GCED, GMON, CEH, ITIL Foundation, ISO 27001 Lead Implementer / Lead Auditor, or vendor training in LogRhythm, SentinelOne, Proofpoint, Microsoft Sentinel, or Defender would be advantageous.

Practical incident response, MSSP/SOC coordination, and LogRhythm experience will be weighted more heavily than certification alone.

What We Are Looking For

We are looking for someone calm and structured under pressure, with strong analytical skills, clear ownership, and a hands‑on approach to problem solving.

They must be confident challenging both suppliers and internal teams when required, while remaining professional and constructive. They must be comfortable working across countries and time zones, particularly with Group IT, Türkiye IT, US IT, and the MSSP/SOC provider.

Excellent professional English, both written and spoken, is mandatory. They must be able to lead technical incident calls, write clear incident summaries, prepare management updates, and communicate effectively with senior stakeholders.