Security operations analyst

Jobgether; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Exposure to Cortex XSIAM/XSOAR andCrow

CrowdStrike Falcon exposure

Multi-cloud security environment

International Security Operations and

Job summary

Jobgether is seeking a security engineering professional to join a high-impact SOC team. You will design and maintain log source integrations with Cortex XSIAM/XSOAR, optimize detection rules, and develop automated response playbooks.

The role spans cloud, identity, endpoint, and enterprise security across AWS, Azure, and Google Cloud. You will collaborate with IT and infrastructure teams, support Tier 2/3 investigations, and contribute to threat intelligence integration and governance practices

Qualifications

• Hands-on experience in Security Operations, SIEM/SOAR engineering, security monitoring, or a related cybersecurity discipline.
• Strong technical expertise in SIEM and SOAR platforms, particularly Palo Alto Cortex XSIAM and XSOAR.
• Experience designing and maintaining log integrations, data parsing, normalization, detection rules, correlation policies, and automated response playbooks.
• Practical experience administering endpoint detection and response platforms, particularly CrowdStrike Falcon, including sensor management, policy configuration, and incident response.
• Strong understanding of cloud security logging and monitoring across AWS, Microsoft Azure, and Google Cloud Platform.
• Familiarity with AWS security services, including GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, EventBridge, SQS, and SNS.
• Knowledge of Azure security technologies, including Microsoft Defender for Cloud, Azure Monitor, and Microsoft Entra ID.
• Experience with GCP Cloud Audit Logs, Security Command Center, and Pub/Sub-based logging integrations is desirable.
• Understanding of Microsoft 365 security monitoring, including Exchange Online, SharePoint, Teams, Conditional Access, and identity-related security events.
• Knowledge of identity and access management principles, privileged access controls, MFA, and least-privilege security practices.
• Ability to investigate complex security incidents, perform technical troubleshooting, and support Tier 2/3 SOC operations.
• Familiarity with threat intelligence, MITRE ATT&CK frameworks, and detection engineering methodologies.
• Strong documentation, analytical, problem-solving, and communication skills.
• Ability to collaborate effectively with security analysts, IT professionals, and infrastructure engineering teams.
• Understanding of security governance, change management procedures, and regulatory compliance requirements.

Responsibilities

• SIEM and SOAR Engineering: Design, deploy, and maintain log source integrations within Cortex XSIAM/XSOAR; develop playbooks for triage and response; manage detection rules and dashboards.
• Security Platform Management: Monitor SIEM health, API rate limits, and log ingestion; maintain runbooks and change records.
• Endpoint Security Engineering: Administer CrowdStrike Falcon, deploy sensors, configure policies, and support investigations.
• Multi-Cloud Security Integration: Configure security log collection across AWS, Azure, GCP; manage integrations with GuardDuty, Security Hub, CloudTrail, and more.
• Cloud Security Monitoring: Ensure cloud telemetry coverage; maintain least-privilege IAM roles and permissions for log collection.
• Identity and Microsoft 365 Security: Maintain Entra ID integrations; monitor Conditional Access, risky sign-ins, and Defender for Cloud/365.
• Security Configuration Reviews: Review identity controls, MFA coverage, guest accounts, and privileged roles.
• SOC Operations and Incident Response: Provide Tier 2/3 engineering support for complex investigations.
• Threat Detection and Continuous Improvement: Translate MITRE ATT&CK into detection logic; contribute to vulnerability management.
• Reporting and Collaboration: Maintain security metrics and collaborate with IT and infrastructure teams on detections and response principles.

Skills

SIEM/SOAR engineering

Palo Alto Cortex XSIAM

Palo Alto XSOAR

Log integrations

Endpoint security (CrowdStrike Falcon)

Cloud security logging

AWS security services

Azure security technologies

GCP Cloud Audit Logs

Microsoft 365 security monitoring

IAM and least-privilege

Threat intelligence & MITRE ATT&CK

Incident response & SOC support

Documentation & communication

Job description

Accountabilities:

• SIEM and SOAR Engineering: Design, deploy, and maintain log source integrations within Palo Alto Cortex XSIAM and XSOAR, ensuring accurate data normalization, parsing, and quality. Develop and continuously improve SOAR playbooks for automated incident triage, enrichment, and response. Manage detection rules, correlation policies, dashboards, and alert thresholds while optimizing detection accuracy and reducing false positives.
• Security Platform Management: Monitor SIEM platform health, connector availability, API rate limits, and log ingestion capacity. Maintain technical documentation, integration runbooks, playbook specifications, and change records in accordance with established change management procedures.
• Endpoint Security Engineering: Administer and optimize the CrowdStrike Falcon platform, including endpoint sensor deployment, security policies, and response workflows. Maintain Falcon integrations with SIEM platforms, validate endpoint detection alerts, and support incident investigations using Real Time Response (RTR) capabilities when required.
• Multi-Cloud Security Integration: Configure and maintain security log collection across AWS, Microsoft Azure, and Google Cloud Platform. Manage integrations involving AWS GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, Azure Defender for Cloud, Azure Monitor, Entra ID, GCP Cloud Audit Logs, and Security Command Center.
• Cloud Security Monitoring: Ensure comprehensive cloud telemetry coverage aligned with security detection requirements and regulatory obligations. Identify and resolve monitoring gaps while maintaining least-privilege IAM roles, service principals, and permissions for log collection.
• Identity and Microsoft 365 Security: Maintain and improve security integrations between Microsoft Entra ID and SIEM platforms, including Conditional Access audit logs, risky sign-in alerts, and identity-based detection use cases. Support Microsoft 365 Defender integrations covering Exchange Online, SharePoint, and Teams.
• Security Configuration Reviews: Assist with periodic reviews of identity security controls, including multi-factor authentication coverage, guest account management, and privileged role assignments. Coordinate with IT teams and elevate security findings through appropriate governance channels.
• SOC Operations and Incident Response: Provide Tier 2/3 engineering support for complex security investigations, helping analysts troubleshoot incidents and improve investigation outcomes.
• Threat Detection and Continuous Improvement: Translate threat intelligence and MITRE ATT&CK tactics, techniques, and procedures into actionable detection logic. Contribute to vulnerability and configuration management activities involving SIEM-connected assets.
• Reporting and Collaboration: Maintain accurate security monitoring metrics and contribute to weekly and monthly SOC reports. Work closely with Security Operations, IT, and infrastructure teams to improve detection capabilities, operational efficiency, and incident response processes.

Requirements:

• Hands-on experience in Security Operations, SIEM/SOAR engineering, security monitoring, or a related cybersecurity discipline.
• Strong technical expertise in SIEM and SOAR platforms, particularly Palo Alto Cortex XSIAM and XSOAR.
• Experience designing and maintaining log integrations, data parsing, normalization, detection rules, correlation policies, and automated response playbooks.
• Practical experience administering endpoint detection and response platforms, particularly CrowdStrike Falcon, including sensor management, policy configuration, and incident response.
• Strong understanding of cloud security logging and monitoring across AWS, Microsoft Azure, and Google Cloud Platform.
• Familiarity with AWS security services, including GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, EventBridge, SQS, and SNS.
• Knowledge of Azure security technologies, including Microsoft Defender for Cloud, Azure Monitor, and Microsoft Entra ID.
• Experience with GCP Cloud Audit Logs, Security Command Center, and Pub/Sub-based logging integrations is desirable.
• Understanding of Microsoft 365 security monitoring, including Exchange Online, SharePoint, Teams, Conditional Access, and identity-related security events.
• Knowledge of identity and access management principles, privileged access controls, MFA, and least-privilege security practices.
• Ability to investigate complex security incidents, perform technical troubleshooting, and support Tier 2/3 SOC operations.
• Familiarity with threat intelligence, MITRE ATT&CK frameworks, and detection engineering methodologies.
• Strong documentation, analytical, problem-solving, and communication skills.
• Ability to collaborate effectively with security analysts, IT professionals, and infrastructure engineering teams.
• Understanding of security governance, change management procedures, and regulatory compliance requirements.

Benefits:

• Opportunity to work with modern enterprise cybersecurity technologies and platforms.
• Hands-on exposure to Palo Alto Cortex XSIAM/XSOAR and CrowdStrike Falcon.
• Experience working across multi-cloud security environments, including AWS, Azure, and GCP.
• Opportunity to contribute to advanced threat detection, automated incident response, and security engineering initiatives.
• Collaboration with international Security Operations and IT teams.
• Exposure to complex enterprise security environments and evolving cybersecurity challenges.
• Opportunities to strengthen technical expertise in SIEM, SOAR, endpoint security, cloud security, and identity protection.
• Equal employment opportunity regardless of race, gender, age, religion, disability, sexual orientation or other legally protected characteristics.