Cyber Defense Engineer

BeyondTrust, Inc.; United States; Remote; USD 87,000 - 134,000; Full time

Benefits offered by this job

Bupa healthcare

Parental leave

Employee Assistance Programme

Learning budgets

AI skills development

Holiday entitlement 25 days

Annual bonus up to 10%

Pension plan

Job summary

BeyondTrust is seeking a Security Operations Engineer to defend enterprise infrastructure and a widely deployed privileged access management product used by thousands of organizations. You will monitor, investigate, and respond to security events within a Cyber Defense Operations team.

You will design and tune detection rules, translate threat intel into content, and contribute to AI-driven triage and investigation workflows.

Qualifications

• Hands-on experience in security operations or incident response across SIEM, EDR, and cloud-native log sources.
• Strong analytical thinking with the ability to produce clear, decision-ready incident documentation.
• Scripting and automation skills in Python, PowerShell, or equivalent applied to security workflows.
• Familiarity with identity and access management platforms and cloud security posture management tools.

Responsibilities

• Triage and investigate alerts across SIEM, EDR, and CSPM platforms covering corporate and product environments.
• Participate in or lead incident response from detection through remediation, including forensic analysis, evidence handling, and post-incident reporting.
• Design, tune, and maintain detection rules mapped to MITRE ATT&CK, reducing false positives and closing coverage gaps.
• Translate threat intelligence from CVE advisories, CISA alerts, and vendor bulletins into actionable detection content.
• Use and help shape AI-driven tools for triage, enrichment, and investigation workflows.
• Collaborate with threat hunting peers to validate detection logic through hypothesis-driven hunts.

Skills

Security operations

Incident response

Python

PowerShell

AI-driven workflows

IAM platforms

Cloud security posture management

Tools

SIEM

EDR

CSPM

Job description

Role overview

This role defends both enterprise infrastructure and the integrity of a widely deployed privileged access management product used by thousands of organizations. As part of a Cyber Defense Operations team, the engineer monitors, investigates, and responds to security events while contributing to detection engineering in an AI-augmented operating model.

Responsibilities

• Triage and investigate alerts across SIEM, EDR, and CSPM platforms covering corporate and product environments
• Participate in or lead incident response from detection through remediation, including forensic analysis, evidence handling, and post-incident reporting
• Design, tune, and maintain detection rules mapped to MITRE ATT&CK, reducing false positives and closing coverage gaps
• Translate threat intelligence from CVE advisories, CISA alerts, and vendor bulletins into actionable detection content
• Use and help shape AI-driven tools for triage, enrichment, and investigation workflows
• Collaborate with threat hunting peers to validate detection logic through hypothesis-driven hunts

Requirements

• Hands-on experience in security operations or incident response across SIEM, EDR, and cloud-native log sources
• Strong analytical thinking with the ability to produce clear, decision-ready incident documentation
• Scripting and automation skills in Python, PowerShell, or equivalent applied to security workflows
• Familiarity with identity and access management platforms and cloud security posture management tools

Nice to have

• Experience with SOAR platforms for automated response and enrichment
• Background designing or implementing AI agent architectures, LLM-based pipelines, or prompt engineering for security use cases
• Experience building or contributing to threat intelligence programs or detection-as-code pipelines
• Understanding of the privileged access management landscape and the threat actors that target it

Benefits and work setup

• Competitive salary with pension and up to a 10% annual bonus
• 25 days of holiday plus additional leave at length-of-service milestones
• Bupa private healthcare for employee and family
• Medicash benefit covering optical and dental care
• Life insurance at 4x salary and income protection
• Paid parental leave with enhanced maternity leave
• Employee Assistance Programme
• Fully remote in the UK with up to 4 weeks per year of working abroad, subject to approval
• Learning budgets including Pluralsight and LinkedIn Learning
• Investment in AI skills development