Information technology security engineer

ASBIS; United States; Ibrido; USD 120.000 - 190.000; Tempo pieno

Vantaggi offerti da questo lavoro

Work-from-home option

Descrizione del lavoro

ASBIS is seeking a hands-on Security Engineering Lead to design and operate a Group-wide SOC, enhancing security controls and conducting internal audits. You will build much of the framework, then scale with MDR/MSSP partners and later a team.

Required 5+ years in technical security, strong Microsoft security expertise, and leadership in SOC or incident response. Remote work options and international exposure are offered.

Competenze

• 5+ years in technical security, incl. 2+ years in SOC, detection engineering or incident response.
• Built (not only operated) a SOC, SIEM or security monitoring process.
• Deep Microsoft security: Entra ID, Conditional Access, Defender XDR, M365 audit logs, KQL.
• Active Directory attack paths and hardening (tiering, BloodHound / PingCastle).
• Windows forensics and EDR telemetry; vulnerability scanners; CIS benchmarks.
• Scripting in Python and/or PowerShell; Git.
• Working knowledge of ISO/IEC 27001:2022 Annex A, NIS2 and GDPR incident notification.
• English B2+ (all documentation in English).
• Certifications: SC-200 / SC-300, GCFA, OSCP / CRTO, ISO 27001 LA is a plus.

Mansioni

• Design the SOC architecture and operating model.
• Tune the SIEM (Wazuh / Microsoft Sentinel) under evaluation.
• Write and maintain detections (KQL, Sigma, Wazuh rules).
• Lead technical incident response: triage, containment, root cause, lessons learned.
• Harden Microsoft 365, Entra ID, Active Directory, Windows/Linux servers, network and backup.
• Own vulnerability scanning and pentest follow-up with IT teams.
• Plan and perform internal technical audits of IT controls; turn findings into actions.
• Audit the controls you built; audits performed independently.
• Manage security vendors (MDR/MSSP, pentesters) against SLAs.
• Automate SOC work (Python / PowerShell, SOAR, AI-assisted triage).

Descrizione del lavoro

Описание:

We are building an ISO/IEC 27001-aligned information security management system, integrated with our ISO 9001 quality system, and preparing for NIS2. This isthe first dedicated security engineering role in the Group: you will design and run a single Group-wide SOC, raise our technical security controls, and run internal technical security audits. It is a hands-on lead role: you build much of it yourself, then grow it with partners (MDR/MSSP) and, later, a team.

Задачи:

• Design the SOC architecture and operating model;
• select and tune the SIEM (Wazuh /Microsoft Sentinel underevaluation).
• Write and maintain detections (KQL, Sigma, Wazuh rules);
• reduce false positives.
• Lead technical incident response: triage, evidence, containment, root cause, lessons learned.
• Harden Microsoft 365, Entra ID, Active Directory, Windows/Linux servers, network and backup.
• Own vulnerability scanning and pentest follow-up with IT teams.
• Plan and perform internal technical audits of IT controls;
• turn findings into tracked actions.
• Audits of controls you built are performed independently.
• Manage security vendors (MDR/MSSP, pentesters) against SLAs.
• Automate SOC work (Python / PowerShell, SOAR, AIassisted triage within Group AI policy).

Требования:

• 5+ years in technical security, incl. 2+ years in SOC, detection engineering or incident response.
• Has built (not only operated) a SOC, SIEM or security monitoring process.
• Deep Microsoft security: Entra ID, Conditional Access, PIM, Intune, Defender XDR, M365 audit logs, KQL.
• Active Directory attack paths and hardening (tiering, BloodHound / PingCastle).
• Windows forensics and EDR telemetry; vulnerability scanners; CIS benchmarks.
• Scripting in Python and/or PowerShell; Git.
• Working knowledge of ISO/IEC 27001:2022 Annex A, NIS2 and GDPR incident notification.
• English B2+ (all documentation in English).
• Будет плюсом: ISO 27001 internal / certification audit experience; multicountry group; Microsoft Sentinel, Azure security, SOAR (Shuffle, TheHive, MISP); Certifications: SC-200 / SC-300, GCIH / GCFA, BTL, OSCP / CRTO, ISO 27001 LA

Условия:

• Work for a financially strong, fast-growing multinational company.
• Access to continuous professional development: training, certification programs, events, and team buildings.
• Competitive salary package and motivation scheme.
• Work-from-home option.
• International career opportunities.