Role Summary
We are seeking a highly skilled and experienced Lead Cybersecurity Engineer to drive the design, engineering, deployment, and optimization of enterprise security controls and platforms. This role requires deep technical expertise in modern security tooling (EDR, SIEM, IDS/IPS, MDM, O365 Security) and the ability to lead implementation initiatives while ensuring alignment with organizational security strategy and compliance requirements.
Key Responsibilities
- Lead the design, engineering, deployment, and continuous improvement of enterprise security tools and platforms, including EDR, SIEM, IDS/IPS, MDM, and O365 security solutions.
- Architect and implement scalable security controls to protect endpoints, networks, cloud workloads, and identity systems.
- Manage and optimize security tool integrations across the environment (e.g., EDR ↔ SIEM ↔ SOAR ↔ MDM).
- Drive incident detection and response engineering, including alert tuning, use case development, and automation playbooks.
- Oversee deployment and enforcement of endpoint security controls (e.g., DLP, USB control, device compliance policies).
- Collaborate with SOC, Infrastructure, IAM, and Cloud teams to ensure security controls are properly implemented and operationalized.
- Lead troubleshooting and root cause analysis of security events, system issues, and tool failures.
- Establish and maintain SIEM use cases, correlation rules, dashboards, and reporting metrics.
- Conduct vulnerability assessments and remediation planning, including tool-based scanning and validation.
- Participate in change management processes, ensuring security impact is assessed and controls are updated accordingly.
- Drive automation initiatives using scripting (PowerShell, Python) and SOAR platforms to reduce manual effort.
- Develop and maintain security baselines, hardening standards, and deployment playbooks for systems and endpoints.
- Monitor emerging threats and adapt controls based on threat intelligence and adversary techniques.
- Provide technical leadership and mentorship to junior engineers and SOC analysts.
Technical Responsibilities:
- Engineer and deploy EDR solutions (e.g., CrowdStrike, Defender for Endpoint) including policy tuning, threat detection, and response actions.
- Implement and manage SIEM platforms (e.g., Crowdstrike NG SIEM, Splunk) including log onboarding, parsing, normalization, and advanced correlation logic.
- Design and support IDS/IPS and network security monitoring solutions for threat visibility and prevention.
- Administer and optimize Microsoft 365 Security (Defender Suite, Entra ID, Conditional Access, Secure Score improvements).
- Manage Mobile Device Management (Intune or equivalent) for compliance, device posture, and access control enforcement.
- Implement identity security controls, including MFA, Conditional Access, Privileged Access, and Zero Trust principles.
- Build and maintain security automation workflows (SOAR) for incident response and operational efficiency.
- Integrate and manage threat intelligence feeds within security tools for proactive detection.
- Perform log source integration across servers, endpoints, network devices, and cloud platforms.
- Support compliance and audit activities (HIPAA/NIST/ISO) by providing evidence, configurations, and technical controls validation.
Cybersecurity Engineer Requirements:
- Strong hands-on experience in security engineering and tool deployment across enterprise environments.
- Proven expertise in incident detection, response, and threat hunting.
- Experience with firewalls, endpoint protection, and cloud security controls, especially in Microsoft ecosystems.
- Working knowledge of programming/scripting languages such as Python, PowerShell, or similar for automation.
- Ability to troubleshoot complex multi-layer security issues across network, endpoint, and cloud environments.
- Strong understanding of modern attack techniques, MITRE ATT&CK framework, and adversary behaviors.
- Experience working in fast-paced SOC or security engineering environments.
Required Qualifications:
- Bachelor's or Master's degree in Information Technology, Computer Science, or a related field.
- 10+ years of experience in IT Security, with at least 5+ years in security engineering / implementation roles.
- Hands-on experience with EDR, SIEM, IDS/IPS, MDM, and O365 Security platforms.
- Strong understanding of security frameworks (NIST, ISO 27001, CIS Benchmarks).
- Experience with vulnerability management tools, IAM/PAM solutions, and cloud security architectures.
- Demonstrated ability to lead technical implementations and drive security projects end-to-end.
- Excellent leadership, stakeholder communication, and project management skills.
- Willingness to work in night shift / 24x7 SOC-support model, if required.
