Security Operations Engineer

Revizto; United States; Remote; USD 122,000 - 171,000; Full time

Job summary

Revizto is seeking a Security Operations Engineer to join our Information Security team. You will identify, investigate, and respond to security threats across cloud, endpoints, and SaaS environments, owning incidents through their lifecycle and improving threat detection capabilities.

You will work closely with Engineering, DevOps, and IT to strengthen our security posture and reduce detection and response times.

Qualifications

• At least 3 years in a SOC, incident response, or security detection role.
• Experience with SIEM (prefer Microsoft Sentinel) and EDR (prefer CrowdStrike Falcon).
• Ability to write, analyze, optimize, and tune security detection queries using KQL or similar languages.
• Solid understanding of MITRE ATT&CK, ISO 27001, NIST, CIS, SOC 2, and cloud security (AWS/Azure).
• End-to-end incident response experience.

Responsibilities

• Monitor, triage, and investigate security alerts across cloud, endpoint, and SaaS environments.
• Lead and coordinate security incident response activities, containment, eradication, recovery, and post-incident reports.
• Develop and refine security detection rules to improve accuracy and reduce false positives.
• Conduct proactive threat-hunting across cloud, endpoint, and identity telemetry.
• Analyze security logs from AWS, Azure/Entra ID, Kubernetes, endpoints, and SaaS apps.
• Investigate cloud security findings and coordinate remediation with system owners.
• Maintain health and onboarding of security log sources to improve monitoring.
• Create and update incident response runbooks and escalation procedures.

Skills

SOC experience

Incident response

Threat detection

KQL

Cloud security

English proficiency

Microsoft Sentinel

CrowdStrike Falcon

Tools

Microsoft Sentinel

CrowdStrike Falcon

Job description

Revizto enables the people behind the world’s most important structures to do their best work. We connect architects, engineers, contractors, and owners in one shared 2D/3D environment to help deliver complex projects on time and on budget. From airports and hospitals to data centers and large-scale infrastructure, Revizto supports industry leaders in reducing risk, improving collaboration, and delivering better project outcomes.

Built on a gaming engine, Revizto is designed to handle the scale and complexity of modern construction projects while remaining fast, reliable, and accessible across devices and environments — whether teams are in the office or on site.

Key Responsibilities & Requirements

• Security Monitoring & Investigation: Monitor, triage, and investigate security alerts and incidents across cloud, endpoint, and SaaS environments, ensuring timely identification and assessment of potential threats.
• Incident Response Management: Lead and coordinate security incident response activities, including containment, eradication, recovery, root-cause analysis, and preparation of comprehensive post-incident reports.
• Threat Detection Engineering: Develop, test, and continuously refine security detection rules to improve accuracy, reduce false positives, and maintain detection coverage aligned with the MITRE ATT&CK framework.
• Proactive Threat Hunting: Conduct proactive threat-hunting activities across cloud, endpoint, and identity telemetry to identify suspicious behavior, emerging threats, and potential security compromises.
• Security Log Analysis: Analyze and correlate security logs and telemetry from AWS, Microsoft Azure/Entra ID, Kubernetes, endpoints, and SaaS applications to detect and investigate potential security incidents.
• Cloud Security & Vulnerability Management: Investigate cloud security findings and vulnerability alerts, collaborate with relevant system owners, and support timely remediation of identified security risks.
• Security Logging & Visibility: Maintain the health, completeness, and reliability of existing security log sources while identifying and onboarding additional sources to improve monitoring and detection coverage.
• Incident Response Documentation: Develop, maintain, and continuously improve incident response runbooks and escalation procedures to ensure consistent and effective handling of security events.

Requirements

• Professional Experience: At least 3 years of hands-on experience in a Security Operations Center (SOC), incident response, or security detection role.
• SIEM & EDR Technologies: Practical experience working with Security Information and Event Management (SIEM) solutions, preferably Microsoft Sentinel, and Endpoint Detection and Response (EDR) platforms, preferably CrowdStrike Falcon.
• Detection Engineering & Query Languages: Ability to write, analyze, optimize, and tune security detection queries using Kusto Query Language (KQL) or similar query languages.
• Cybersecurity Fundamentals: Solid understanding of common cyberattack techniques, threat behaviors, and the MITRE ATT&CK framework, combined with a strong foundation in AWS and Azure cloud security principles.
• End-to-End Incident Response: Proven experience managing security incidents throughout their entire lifecycle, from initial alert investigation and triage through containment, eradication, recovery, root-cause analysis, and post-incident reporting.
• Security Frameworks & Standards: Knowledge of established information security frameworks and standards, including ISO 27001, NIST, CIS, and SOC 2.
• English Proficiency: Upper-intermediate (B2) or higher proficiency in English, both written and spoken.

Preferred Qualifications

• Hands-on experience conducting proactive threat-hunting activities to identify and investigate potential security threats.
• Knowledge of Kubernetes and container security principles, including common risks and security considerations in containerized environments.
• Basic scripting skills in Python, PowerShell, or Bash to support security investigations, analysis, and operational tasks.
• One or more relevant professional certifications, such as GCIH, GCIA, GCFA, GCTI, Microsoft SC-200, or CrowdStrike CCFA/CCFH.

Personal & Professional Competencies

• Composure Under Pressure: Ability to remain calm, structured, and focused when managing security incidents and working under time-sensitive conditions.
• Communication & Reporting: Strong written communication skills, with the ability to clearly explain security incidents, technical findings, and their impact to both engineering teams and executive stakeholders.
• Collaboration & Ownership: A proactive team player who can work effectively both independently and collaboratively, take ownership of responsibilities, and continuously identify opportunities to improve security processes.
• Relationship Building: Ability to establish and maintain strong, productive working relationships with colleagues across teams and at all organizational levels.

Position Overview

We are looking for a Security Operations Engineer to join our Information Security team and play a key role in protecting Revizto 's cloud infrastructure, endpoints, and SaaS environments.

In this role, you will be at the forefront of identifying, investigating, and responding to security threats, ensuring that potential risks are detected and addressed effectively. You will take ownership of security incidents throughout their lifecycle, continuously improve threat detection capabilities, and proactively identify vulnerabilities and emerging threats.

Working closely with Engineering, DevOps, and IT teams, you will contribute to strengthening our overall security posture, enhancing detection coverage, and reducing incident detection and response times. This is an opportunity to take ownership of meaningful security challenges and directly contribute to the protection and resilience of Revizto 's technology environment.

Why Join Us

• Recognised as one of Switzerland’s Best Managed Companies by Deloitte for three consecutive years from 2024 through
• Company-wide trips, including Armenia in 2023 and Switzerland in 2025, with more to come
• A flexible, employee-focused culture
• An innovative and collaborative team environment
• Great working conditions designed to support your best work

We can only accept applications from candidates based in Germany, Armenia, France or the UK.