Senior L3 Security Operations Specialist - Onsite Istanbul

AMARIS GROUP SA; Fatih; On-site; TRY 180,000 - 300,000; Full time

Job summary

Amaris Consulting is seeking an L3 Security Operations Specialist to join our cybersecurity operations team in Istanbul. You will handle complex escalations, investigate incidents, and improve detection rules while supporting customers and internal teams on critical cases.

The role requires hands-on experience with SIEM platforms and EDR/NDR/XDR technologies, plus strong documentation and communication skills in English.

Qualifications

• 2+ years in cybersecurity operations or incident response.
• Hands-on with at least one SIEM platform (QRadar/Logsign/Graylog).
• Experience with EDR/NDR/XDR technologies.
• Knowledge of MITRE ATT&CK and Cyber Kill Chain is a plus.

Responsibilities

• Handle L3 escalations related to SIEM, EDR, NDR and XDR platforms.
• Investigate security events and identify root causes of technical issues.
• Troubleshoot product configuration, integration, correlation and alerting problems.
• Create, test and maintain detection rules and correlation use cases.
• Map detection rules to the MITRE ATT&CK framework and Cyber Kill Chain.
• Review false positives and improve alert quality.
• Support Incident Response and DFIR activities.
• Perform threat hunting and document findings.
• Analyse suspicious files, behaviours and malware-related events.
• Support security products such as firewalls, WAF, IDS and IPS.
• Work with vendors during advanced technical escalations.
• Communicate with customers during high-priority incidents.
• Prepare root cause analysis documents, technical reports and runbooks.
• Work closely with SOC, Threat Intelligence, Infrastructure and Security teams.
• Provide technical guidance to L1 and L2 support teams.

Skills

Cybersecurity ops

Incident response

English comms

Tools

SIEM tools

Job description

Amaris Consulting is seeking an L3 Security Operations Specialist to join our cybersecurity operations team in Istanbul. You will handle complex escalations, investigate incidents, and improve detection rules while supporting customers and internal teams on critical cases.

The role requires hands-on experience with SIEM platforms and EDR/NDR/XDR technologies, plus strong documentation and communication skills in English.