incident response engineer

Deloitte

<div>
 
 Cyber Security I Incident Response Senior Engineer
 
 
 ,
 
 
 Cairo. Egypt
 
 
 
 
 Connect to your career at Deloitte
 
 
 
 
 Deloitte
 
 
 ,
 
 established globally in 1845, is the world&rsquo;s largest and leading professional services firm, providing Audit &amp; Assurance, Tax &amp; Legal and Consulting and related services to public and private clients spanning multiple industries. Present in more than 150 countries, Deloitte is distinct in its ability to help clients solve their most complex problems, from strategy to implementation.
 
 
 Deloitte innovation hub (DIH) is a strategic initiative/priority established by Deloitte North &amp; South Europe (NSE) to support our ambition to become the leading business transformation partner of choice for our clients and to expand and scale our delivery footprint across EMEA. With access to a scaled, diverse, highly skilled, motivated, and engaged workforce, DIH is delivering complex technical solutions for clients&rsquo; most complex business problems, across Portfolios that include &lsquo;Strategy &amp; Transactions&rsquo;, &lsquo;Customer&rsquo;, &lsquo;Engineering, AI &amp; Data, &lsquo;Enterprise, Technology &amp; Performance&rsquo; and &lsquo;Cyber&rsquo;. DIH is aiming to become the destination for top talents in Egypt for a long, exciting career.
 
 
 We invest in outstanding people of diverse talents and backgrounds and empower them to achieve more than they could elsewhere. Our work combines advice with action and integrity. We believe that when our clients and society are stronger, so are we. Our organization has grown in scale and diversity, providing services across the region, with our shared culture remaining the same. We aim to help clients realize their ambitions, make a positive difference in society, and maximize the success of our people. This drive fuels the commitment and humanity that run deep through our every action.
 
 
 
 Connect to your opportunity.
 
 
 
 As a
 
 Digital Forensics
 
 
 Incident Response Senior Engineer
 
 
 ,
 
 you will be assisting clients with response to Cyber Incidents &amp; getting back to business, this includes data leaks, ransomware, unusual network traffic. Cyber criminals, from insider threat to nation-state sponsored hackers.
 
 
 
 Your Role Will Also Include The Following
 
 
 
 <ul>
 <li>
 Conduct analysis of log files, Windows event logs (Windows artifacts), and Linux artifacts to identify correlations using EDR, network monitoring tools, and SIEM platforms (e.g., Splunk, Microsoft Security Suite, and CrowdStrike Falcon). The role requires applying knowledge of forensic artifacts across various client platforms.
 </li>
 <li>
 Conduct in-depth analysis of malware, threat intelligence, and other relevant sources.
 </li>
 <li>
 Provide tactical support such as advice on triage, containment, eradication, and broader coordination during cyber incidents.
 </li>
 <li>
 Perform forensic analysis of systems and networks.
 </li>
 <li>
 Execute memory forensics.
 </li>
 <li>
 Perform Compromise Assessments and Threat Hunting projects in SIEM and EDR tooling.
 </li>
 <li>
 Create custom scripts (using Python) for parsing special log files, data sets, and images, etc.
 </li>
 <li>
 Create complex timelines based on findings and observations.
 </li>
 <li>
 Act as a member of the broader Deloitte Response Team, adding CIR skills to the overall team that includes privacy, crisis management, crisis communication, forensic investigations, and ICS/OT.
 </li>
 <li>
 Partake in the EMEA and Global technical incident responder community to build a strong network and share a knowledge base.
 </li>
 <li>
 Maintain flexible working hours to support the customer during high-impact incidents.
 
 
 </li>
 </ul>
 
 Connect To Your Skills And Professional Experience
 
 
 
 To succeed in this role, you need to have the following:
 
 
 <ul>
 <li>
 At least 3 years of experience in Cyber Incident Response and digital forensics, or similar response experiences in operational environments.
 </li>
 <li>
 Hands-on skills to perform sharp and in-depth analyzes, both using tooling such as EDR and network sensors, but also manual analysis, if the tools are not available.
 </li>
 <li>
 Broader experience in other technical areas of information security, such as penetration testing, threat intelligence or security operations, is beneficial.
 </li>
 <li>
 Experience in systems and/or network administration, engineering or architecture is a highly advantageous.
 </li>
 <li>
 Ability to work under pressure and keep track of the big picture while performing in-depth analysis.
 </li>
 <li>
 Ability to apply analytical insights at an organizational level, considering wider implications and threat actor attack paths and lifecycles.
 </li>
 <li>
 Relevant academic qualifications such as Master&rsquo;s or bachelor&rsquo;s degree in computer science, information security or related fields.
 </li>
 <li>
 Relevant industry qualifications to demonstrate understanding, for example CISSP, CISM, GCFE, GCFA, GREM, GCIH, CCIM, GCIA, CCNIA, CCHIA, CCMRE or similar
 
 
 </li>
 </ul>
 
 The Following Attributes Are Essential
 
 
 
 <ul>
 <li>
 Strong written, verbal and presentation skills.
 </li>
 <li>
 A willingness to work as part of a diverse team.
 </li>
 <li>
 A commitment to continuous improvement and lifelong learning.
 </li>
 <li>
 A passion for technology and a drive to deliver secure, high-quality solutions.
 </li>
 <li>
 Strong analytical and problem-solving skills.
 </li>
 <li>
 Excellent communication and interpersonal abilities.
 </li>
 <li>
 Ability to work effectively in a fast-paced and dynamic environment.
 </li>
 <li>
 Proactive and self-motivated with a keen attention to detail.
 
 
 </li>
 </ul>
 
 Connect to your service line &ndash; Technology and Transformation
 
 
 
 Distinctive thinking, deep expertise, and collaborative working. That&rsquo;s what connects us. That&rsquo;s what makes us Deloitte. If you want to help solve some of the biggest challenges around, join us. Together, we&rsquo;ll make an impact that matters.
 
 
 
 Personal independence
 
 
 
 Regulation and controls are standard practice in our industry and Deloitte is no exception. These controls provide important legal protection for both you and the firm. We are subject to several audit regulations, one of which requires that certain colleagues abide by specific personal independence constraints. This can mean that you and your "Immediate Family Members" are not permitted to hold certain financial interests (shares, funds, bonds etc.) with audit clients of the firm. The recruitment team will provide further detail as you progress through the recruitment process.
 
 
 
 Connect to your Industry
 
 
 
 &ldquo;What attracted me to Deloitte were the endless opportunities and the collective experience of other like-minded individuals. Deloitte&rsquo;s clients include many of the world&rsquo;s largest organizations; I wanted to be part of a team that made a difference that I could be proud of.&rdquo; Dan, T&amp;T.
 
 
 
 Connect with your colleagues
 
 
 
 Location: Cairo. Egypt
 
 
 Your Work, Your Way: We call our hybrid working vision Deloitte Works. And it does. We trust you to make the right choices around where, when, and how you work. You&rsquo;ll be able to make decisions about how you work best, to be collaborative, learn from colleagues, share your experiences, build the relationships that will fuel your career and prioritize your wellbeing. Having great conversations with your team and your leadership paves the way for great collaborative ways of working.
 
 
 
 Our commitment to you
 
 
 
 Making an impact is more than just what we do: it&rsquo;s why we&rsquo;re here. So we work hard to create an environment where you can experience a purpose you believe in, the freedom to be you, and the capacity to go further than ever before.
 
 
 We want you. The true you. Your own strengths, perspective, and personality. So, we&rsquo;re nurturing a culture where everyone belongs, feels supported and heard, and is empowered to make a valuable, personal contribution. You can be sure we&rsquo;ll take your wellbeing seriously, too. Because it&rsquo;s only when you&rsquo;re comfortable and at your best that you can make the kind of impact you, and we, live for.
 
 
 Your expertise is our capability, so we&rsquo;ll make sure it never stops growing. Whether it&rsquo;s from the complex work you do, or the people you collaborate with, you&rsquo;ll learn every day. Through world-class development, you&rsquo;ll gain invaluable technical and personal skills. Whatever your level, you&rsquo;ll learn how to lead.
 
 
 
 Connect to your next step
 
 
 
 A career at Deloitte is an opportunity to develop in any direction you choose. Join us and you&rsquo;ll experience a purpose you can believe in and an impact you can see. You&rsquo;ll be free to bring your true self to work every day. And you&rsquo;ll never stop growing, whatever your level.
</div>

Deloitte Innovation Hub I Cyber Security I Digital Forensics Incident Response Senior Engineer, Cairo, Egypt.

LinkedIn

<div>
 
 Company Description
 
 
 
 LinkedIn is the world&rsquo;s largest professional network, built to create economic opportunity for every member of the global workforce. Our products help people make powerful connections, discover exciting opportunities, build necessary skills, and gain valuable insights every day. We&rsquo;re also committed to providing transformational opportunities for our own employees by investing in their growth. We aspire to create a culture that&rsquo;s built on trust, care, inclusion, and fun &ndash; where everyone can succeed.
 
 
 Join us to transform the way the world works.
 
 
 
 Job Description
 
 
 
 At LinkedIn, our approach to flexible work is centered on trust and optimized for culture, connection, clarity, and the evolving needs of our business. The work location of this role is hybrid, meaning it will be performed both from home and from a LinkedIn office on select days, as determined by the business needs of the team.
 
 
 This role will be hybrid in LinkedIn's Sunnyvale campus.
 
 
 
 About The Team
 
 
 
 LinkedIn's members entrust us with their information every day and we take their security seriously. Our core value of putting our members first powers all the decisions we make, including how we manage and protect the data of our members and customers. We never stop working to ensure LinkedIn is secure. We follow industry standards and have developed our own best practices to stay ahead of the increasing number of threats facing all Internet services and infrastructure. LinkedIn is looking for a Senior Incident Response Engineer to be an integral part of our Information Security organization. The Incident Response team is responsible for protecting our infrastructure, applications, and, most importantly, our members. This role will be responsible for playing a key role in our security monitoring and incident response team.
 
 
 The role is a Senior position, coming in with years of real world experience in responding and leading incident investigations, developing playbooks, and continually striving to improve processes and response times. Additionally as a Senior, a successful candidate will help lead the continued improvements, mentor more junior team members, while acting as a lead during large scale incidents.
 
 
 Responsibilities:
 
 
 <ul>
 <li>
 Independently triage security alerts and incident reports.
 </li>
 <li>
 Investigate incidents using available resources, forensic and threat hunting skills.
 </li>
 <li>
 Drive small to medium scale incidents with multiple team members and partner teams to closure.
 </li>
 <li>
 Conduct host, network, and log analysis in support of incident response investigations
 </li>
 <li>
 Enhance our in-house incident response platforms and build new capabilities.
 </li>
 <li>
 Participate in oncall activities.
 </li>
 <li>
 Work with partner teams including: PR, HR, Legal, Compliance, Investigations, Microsoft CDOC, Engineering, EPE.
 </li>
 <li>
 Work in a team environment to drive large scale incidents to closure and full remediation.
 </li>
 <li>
 Contribute to improving processes, procedures and technologies used by the team.
 </li>
 <li>
 Provide feedback to detection engineering team about accuracy and quality of detections
 </li>
 <li>
 Provide proactive and accurate data to all stakeholders for internal communication
 </li>
 <li>
 Help uplift entire team by providing demonstration of new processes or training on systems
 </li>
 <li>
 Support mentoring and technical development of incident response engineers
 
 
 
 </li>
 </ul>
 
 Qualifications
 
 
 
 Basic Qualifications:
 
 
 <ul>
 <li>
 BA/BS degree in Information Security, CyberSecurity, Computer Science, or other related technical disciplines, or equivalent practical experience
 </li>
 <li>
 4+ years experience in Information Security, with 3+ years experience in Incident Response as part of that experience.
 </li>
 <li>
 Incident response experience should include:
 </li>
 <li>
 Experience with triaging security alerts.
 </li>
 <li>
 Experience with incident lifecycle and incident handling.
 </li>
 </ul>
 <ul>
 <li>
 Experience with log analysis
 </li>
 <li>
 Experience with SIEM solutions
 </li>
 <ul>
 <li>
 Experience with Windows and Unix operating systems logs.
 </li>
 <li>
 Experience with Web Server logs.
 </li>
 </ul>
 <li>
 Experience with EDR solutions
 </li>
 <li>
 Experience with system level analysis - windows, linux, and mac.
 </li>
 <li>
 Experience with 1 or more of these areas:
 </li>
 <ul>
 <li>
 System Forensics
 </li>
 <li>
 Network Forensics
 </li>
 <li>
 Cloud Forensics
 </li>
 <li>
 SOAR/Security Orchestration
 </li>
 <li>
 Threat Intelligence
 
 </li>
 </ul>
 </ul>
 Preferred Qualifications:
 
 
 <ul>
 <li>
 Master&rsquo;s degree in Information Security, CyberSecurity, Computer Science, or other related technical disciplines.
 </li>
 <li>
 Developer experience, the ability to understand source code and develop scripts.
 </li>
 <li>
 Practical threat hunting experience with open source tool chain
 </li>
 <li>
 Scripting knowledge to automate repetitive, time consuming and error prone activities using a general purpose scripting language (ex: Python)
 </li>
 <li>
 Prior experience with malware analysis
 
 
 
 </li>
 </ul>
 Suggested Skills:
 
 
 <ul>
 <li>
 Information Security
 </li>
 <li>
 Incident Response
 </li>
 <li>
 Threat Hunting
 
 
 
 </li>
 </ul>
 You will Benefit from our Culture
 
 
 We strongly believe in the well-being of our employees and their families. That is why we offer generous health and wellness programs and time away for employees of all levels.
 
 
 LinkedIn is committed to fair and equitable compensation practices. The pay range for this role is $125,000 - $206,000. Actual compensation packages are based on a wide array of factors unique to each candidate, including but not limited to skill set, years &amp; depth of experience, certifications and specific office location. This may differ in other locations due to cost of labor considerations.
 
 
 The total compensation package for this position may also include annual performance bonus, stock, benefits and/or other applicable incentive compensation plans. For additional information, visit: https://careers.linkedin.com/benefits.
 
 
 
 Additional Information
 
 
 
 
 Equal Opportunity Statement
 
 
 
 We seek candidates with a wide range of perspectives and backgrounds and we are proud to be an equal opportunity employer. LinkedIn considers qualified applicants without regard to race, color, religion, creed, gender, national origin, age, disability, veteran status, marital status, pregnancy, sex, gender expression or identity, sexual orientation, citizenship, or any other legally protected class.
 
 
 LinkedIn is committed to offering an inclusive and accessible experience for all job seekers, including individuals with disabilities. Our goal is to foster an inclusive and accessible workplace where everyone has the opportunity to be successful.
 
 
 If you need a reasonable accommodation to search for a job opening, apply for a position, or participate in the interview process, connect with us at accommodations@linkedin.com and describe the specific accommodation requested for a disability-related limitation.
 
 
 Reasonable accommodations are modifications or adjustments to the application or hiring process that would enable you to fully participate in that process. Examples of reasonable accommodations include but are not limited to:
 
 
 <ul>
 <li>
 Documents in alternate formats or read aloud to you
 </li>
 <li>
 Having interviews in an accessible location
 </li>
 <li>
 Being accompanied by a service dog
 </li>
 <li>
 Having a sign language interpreter present for the interview
 
 
 
 </li>
 </ul>
 A request for an accommodation will be responded to within three business days. However, non-disability related requests, such as following up on an application, will not receive a response.
 
 
 LinkedIn will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by LinkedIn, or (c) consistent with LinkedIn's legal duty to furnish information.
 
 
 
 San Francisco Fair Chance Ordinance
 
 
 
 Pursuant to the San Francisco Fair Chance Ordinance, LinkedIn will consider for employment qualified applicants with arrest and conviction records.
 
 
 
 Pay Transparency Policy Statement
 
 
 
 As a federal contractor, LinkedIn follows the Pay Transparency and non-discrimination provisions described at this link: https://lnkd.in/paytransparency.
 
 
 
 Global Data Privacy Notice for Job Candidates
 
 
 
 Please follow this link to access the document that provides transparency around the way in which LinkedIn handles personal data of employees and job applicants: https://legal.linkedin.com/candidate-portal.
 
 
</div>

Senior Information Security Engineer - Incident Response

Samsung Electronics

<div>Samsung SDS America (SDSA) serves as the U.S. technology and innovation hub for Samsung&rsquo;s global enterprise solutions, delivering secure, scalable, and high‑performance IT services that support some of the world&rsquo;s most complex business environments. As SDSA continues to expand its cloud, mobility, analytics, and cybersecurity capabilities, maintaining a resilient security operations foundation is essential to protecting the company&rsquo;s digital assets and ensuring uninterrupted service delivery. This need for operational rigor and real‑time threat defense creates the environment in which the Security Operations Engineer plays a critical role. 
The Security Operations Engineer is responsible for three core operational pillars: daily security operations management, real‑time threat detection and incident response, and security control governance and optimization. The role oversees the day‑to‑day execution, ensuring the integrity, confidentiality, and availability of enterprise systems by actively monitoring networks through SIEM, DLP, and secure web gateway technologies. The engineer leads the full incident response lifecycle&mdash;validating alerts, coordinating escalation paths, conducting forensic investigations to determine root cause, and executing targeted remediation to prevent recurrence. 
Responsibilities:<ul><li>
Manage daily functions of security operations, while protecting the integrity, confidentiality and availability of information technology resources.</li><li>
Administer network and computer system level security controls that help enforce policies and procedures.
</li><li>Ability to create standard procedures/run books for managing and maintaining various security controls.
</li><li>Coordinate and administer maintenance and upkeep of security-related control systems, including anti-virus, firewalls, intrusion prevention systems, secure web gateway etc.
</li><li>Ensure appropriate incident response procedures and processes exist, including identifying and establishing appropriate escalation/communication chain.
</li><li>Carry out forensic investigations to root cause security incidents/breaches and carry out effective remediation activities.</li><li>
Daily monitoring of enterprise networks using security controls such as SIEM, DLP and secure Web Gateway and coordinate incident response activities based on the events and alerts generated by security controls.</li><li>
Work closely with Security engineering team in instituting an effective Threat &amp; Vulnerability Management program.</li><li>
Assist in reviewing existing security controls and help identify security risks.
</li><li>Work closely with security architecture team in recommending effective security controls to mitigate and minimize security risks.</li><li>
Create and maintain security operations dashboard, showing risk areas and common threats.</li></ul> 

Requirements 
<ul><li>
4+ years' experience directly related to information technology security in medium to large enterprise.
</li><li>Demonstrated experience with network and IT security components, including firewalls, intrusion detection systems, anti-malware software, data encryption, VPN, vulnerability scanners, server operating systems, and other industry-standard techniques and practices.
</li><li>Demonstrated ability to perform penetration testing (system, network, application) and security control configuration review to identify gaps and develop effective remediation strategies to address the gaps.
</li><li>Demonstrated ability to develop metrics, performs critical analysis, and develops executive decision support content.
</li><li>Excellent communication skills with the ability to write documents ranging from formal and informal reports, system documentation, and training materials.
</li><li>Experience in project management and change management procedures and techniques.</li><li>
Experience managing information security controls, specifically monitoring, troubleshooting, maintaining, and modernization of mission critical networks and information systems.
</li><li>Must be familiar with a wide range of security technologies including, but not limited to: SIEM, IDS/IPS, malware analysis and protection, content filtering, logical access controls, identity and access management, data loss prevention, content filtering technologies, application firewalls, vulnerability scanners, LDAP, forensics software, security incident response and Identity Management.</li><li>
Must be willing and able to work onsite in San Jose, CA.</li></ul>
Preferred Qualifications:<ul><li>
Experience with project management, vendor management, and policy development.</li><li>
Prior experience in leading or being part of a security incident response team and proven experience in using SIEM and network DLP.</li><li>
Ability to work in a small, collaborative team environment and as an individual contributor.</li><li>
Bachelor&rsquo;s Degree in relevant field is strongly preferred.</li></ul> 

Benefits 
Samsung SDSA offers a comprehensive suite of programs to support our employees:<ul><li>
Top-notch medical, dental, vision and prescription coverage</li><li>
Wellness program</li><li>
Parental leave</li><li>
401K match and savings plan</li><li>
Flexible spending accounts</li><li>
Life insurance</li><li>
Paid Holidays</li><li>
Paid Time off</li><li>
Additional benefits</li></ul>
Samsung SDS America, Inc. is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity or expression, national origin, disability, status as a protected veteran, marital status, genetic information, medical condition, or any other characteristic protected by law.
We are committed to providing reasonable accommodations to participate in the job application or interview process for candidates with disabilities. Please let your recruiter know if you need an accommodation at any point during the interview process.
The base pay range for this role is USD $125,000 - $150,000 per year depending on appropriate skills, experience, and technical level.
Individual base pay depends on various factors, in addition to primary work location, such as complexity and responsibility of role, job duties/requirements, and relevant experience and skills.
Certain roles are eligible for additional rewards, including annual bonus. U.S.-based employees have access to medical, dental, and vision insurance, a 401(k) plan and company match, short-term and long-term disability coverage, basic life insurance, and wellbeing benefits, among others. U.S.-based employees also receive, per calendar year, up to 10 scheduled paid holidays, and Paid Time Off.</div>

Security Operations (SecOps) Engineer

DYOPATH

<div><div><h1 class="jobSectionHeader">Join DYOPATH as a SNOC Engineer III (Security)</h1>

Are you energized by solving complex security challenges and helping protect environments from evolving cyber threats?

DYOPATH is looking for a SNOC Engineer III (Security) who thrives on advanced problem‑solving, technical leadership, and a commitment to operational excellence in a fast‑paced security operations environment.

<h1 class="jobSectionHeader">Why You'll Love Working Here</h1>
<ul><li>Purpose with Passion &ndash; A culture guided by the L.O.V.E. philosophy (Living Our Values Every Day).</li>
<li>Grow &amp; Thrive &ndash; Certifications, security training, and professional development opportunities.</li>
<li>Award-Winning Culture &ndash; Known for outstanding service internally and externally.</li>
<li>Teamwork &amp; Respect &ndash; A collaborative, uplifting environment where achievements are celebrated.</li>
</ul><h1 class="jobSectionHeader">Benefits</h1>
<ul><li>Medical, Dental &amp; Vision Coverage</li>
<li>Life Insurance</li>
<li>401(k) with company match</li>
<li>&quot;You Pick a Day&quot; paid holiday</li>
<li>FSA &amp; HSA options</li>
<li>Pet Insurance</li>
<li>&hellip;and more!</li>
<li>Full benefits overview available at dyopath.com/careers</li>
</ul><h1 class="jobSectionHeader">Role Overview</h1>
<ul><li>Location: Remote</li>
<li>Schedule: 2nd Shift (4 PM&ndash;1 AM CT), Friday through Tuesday</li>
<li>Salary: $98,000 annually</li>
</ul><h1 class="jobSectionHeader">Your Mission as a SNOC Engineer III (Security)</h1>
<ul><li>Drive continuous improvement within SNOC security operations by identifying opportunities to enhance monitoring, response workflows, automation, and operational efficiency</li>
<li>Serve as the primary escalation point for complex security incidents, providing advanced technical analysis and resolution support to the SNOC engineering team.</li>
<li>Support the development and maintenance of operational documentation including security runbooks, incident response procedures, investigation guides, and knowledge base articles.</li>
<li>Identify and analyze potential security risks, vulnerabilities, and suspicious activity across network, system, endpoint, identity, and cloud environments, recommending remediation actions.</li>
<li>Assist in strengthening security monitoring capabilities by improving detection logic, tuning alerts, and contributing to SIEM analytics rules and automation workflows.</li>
<li>Provide mentorship and technical guidance to junior SNOC engineers during investigations, troubleshooting, and incident response activities.</li>
<li>Support security compliance initiatives by ensuring operational activities, incident investigations, and response actions are properly documented to support audits and reporting.</li>
<li>Participate in validation and testing of incident response procedures, disaster recovery plans, and operational readiness exercises.</li>
</ul><h2 class="jobSectionHeader">Security Operations</h2>
<ul><li>Act as the technical lead for high-severity security incidents, coordinating investigation activities and guiding containment, eradication, and recovery efforts.</li>
<li>Perform advanced threat analysis using SIEM, EDR, identity protection, and network telemetry platforms to identify malicious or suspicious activity.</li>
<li>Investigate complex security alerts and correlated incidents across endpoint, identity, email, cloud, and network security platforms.</li>
<li>Develop and refine detection capabilities including SIEM analytics rules, threat hunting queries, alert enrichment logic, and automated response playbooks.</li>
<li>Provide escalation support during major incidents, assisting with root cause analysis, containment strategies, and post-incident documentation.</li>
<li>Collaborate with engineering, infrastructure, and client teams to implement remediation actions and long-term risk mitigation strategies.</li>
<li>Support onboarding and integration of security telemetry from new platforms and security technologies into the monitoring environment.</li>
<li>Ensure security investigations, incidents, and operational actions are accurately documented within ticketing and case management systems.</li>
</ul><h1 class="jobSectionHeader">What You Bring to the Team</h1>
<h2 class="jobSectionHeader">Education &amp; Certifications</h2>
<ul><li>Bachelor's degree in Cybersecurity, Information Technology, or related field preferred (or equivalent experience).</li>
<li>Preferred professional certifications:
<ul><li>GIAC (GCIH, GCIA, GCFA)</li>
<li>CompTIA CySA+ or CASP+</li>
<li>Microsoft Certified: Azure Security Engineer Associate</li>
<li>AWS Certified Security &ndash; Specialty</li>
<li>Cisco CCNP or equivalent</li>
</ul></li></ul><h2 class="jobSectionHeader">Experience &amp; Skills</h2>
<ul><li>Advanced knowledge of security operations, incident investigation, and threat detection methodologies.</li>
<li>Experience with SIEM and security monitoring platforms such as Microsoft Sentinel, Wazuh, SentinelOne, or similar technologies.</li>
<li>Strong understanding of networking fundamentals, endpoint security, identity protection, and cloud security environments (Azure, AWS, or similar).</li>
<li>Experience performing advanced log analysis, threat hunting, and alert triage across multiple telemetry sources.</li>
<li>Ability to troubleshoot complex security issues and provide leadership during high-severity operational events.</li>
<li>Strong written and verbal communication skills for both internal operational documentation and client-facing discussions.</li>
<li>Experience improving security monitoring through detection engineering, alert tuning, and security automation.</li>
<li>Familiarity with security frameworks, compliance standards, and operational security best practices.</li>
</ul><h1 class="jobSectionHeader">Why This Role Rocks</h1>

As a SNOC Engineer III (Security), you won't just respond to threats&mdash;you will help shape DYOPATH's security posture. You'll lead advanced investigations, engineer better detection capabilities, mentor teammates, and make a direct impact on protecting clients. You'll grow your expertise while contributing to a team that values collaboration, curiosity, and continuous improvement.</div><div> 
Equal Opportunity Employer

DYOPATH is committed to a work environment free of all forms of discrimination. DYOPATH recruits and hires without regard to age, color, disability, gender, gender identity, genetic information, marital status, military status, national origin, race, religion, sexual orientation, veteran status, or any other legally protected characteristic. For more information about DYOPATH, please visit our website at www.dyopath.com. The above information has been designed to indicate the general nature and level of work performed by employees in this classification. It is not designed to contain or to be interpreted as a comprehensive inventory of all duties, responsibilities, and qualifications required of the employee assigned to this job.</div></div>

SNOC Engineer III (Security)

HCA Healthcare

<div>Do you have the career opportunities as a(an) Security Threat Engineer I you want with your current employer? We have an exciting opportunity for you to join HCA Healthcare which is part of the nation's leading provider of healthcare services, HCA Healthcare.
Job Summary
The Threat Response Engineer 1 &ndash; serving as the last line of defense between HCA and the threat actors that wish to bring harm to HCA and the patients we serve &ndash; is a critical member of the 24/7 CDC team. They will use state of the art technologies to detect threats on our network and eradicate them as a member of our Cyber Defense Center (CDC). As a member of the CDC, they will operate along with a small team of like-minded individuals with a passion for cyber security.
This role will provide Tier 1 and Tier 2 analysis and response to cyber security threats. Threat Response Engineers will be expected to detect malicious activity and support the business through the Incident Response process for both routine and major events. Successful candidates will have a passion for cybersecurity and be naturally curious and self-motivated to investigate and discover root causes of events while working in a fast-paced and sometimes stressful environment. Good teamwork and communication skills are also vital. Our team operates as a close-knit group serving a noble purpose &ndash; to win the fight against evil every day.
Major Responsibilities:<ul><li>
Monitor security alert queue &ndash; investigate and triage events based on criticality. Provide recommendations on how to mitigate the threats. Use analytic techniques and critical thinking to determine if and when to escalate threats to larger Cyber Security team.</li><li>
Provide guidance to field resources on how to properly remediate a threat.</li><li>
Work closely with other CDC team members to improve tools, techniques, and procedures for CDC operation.</li><li>
Continuously improve documentation of work products and processes.</li><li>
Participate in red/blue team exercises.</li><li>
Execute HCA&rsquo;s Incident Response plan as part of an incident response team. Serve as Incident Commander, Task Lead, or Scribe during incidents.</li><li>
Routinely collaborate with individuals and teams from across the enterprise.</li></ul>
Education and Experience<ul><li>
Bachelor's degree preferred</li><li>
1+ years of relevant experience</li></ul>
Desired Experience:<ul><li>
Experience as a member of a Cyber Incident Response Team (CIRT) or comparable team.</li><li>
Experience executing an Incident Response plan, preferably based on recognized industry standards (e.g. &ndash; NIST, SANS, etc).</li><li>
Experience in Windows Artifact Analysis and Initial Forensic Analysis (e.g. &ndash; Program Execution, File/Folder opening, Account Usage, pulling memory, following proper evidence handling procedures, etc) using industry standard tools and available logs (e.g. &ndash; Endpoint Detection and Response (EDR) tools).</li><li>
Experience in Memory Analysis using tools such as Volatility</li><li>
Experience in network forensic analysis to determine validity of detected events using available network logs collected via SEIM.</li><li>
Experience in DFIR (Digital Forensics Incident Response).</li><li>
Experience with an event/information analysis framework such as Analysis of Competing Hypotheses (ACH). Rev Date 07152025</li><li>
Experience in performing security analysis or reporting utilizing Security Incident and Event Management (SIEM) Technologies. Preferably Splunk and SPL experience.</li><li>
Experience with document management and sustaining Security Operations Center (SOC) policies and run book procedures for incident response.</li><li>
Experience with documenting root cause analysis and lessons learned.</li><li>
Experience consuming and generating cybersecurity threat intelligence.</li><li>
Experience across the technology stack. Familiarity with all OSI layers and expertise in some.</li><li>
Experiencing using the following types of security tools:</li><li><ul><li>
SIEM o Firewalls o Web Proxy o Anti-Virus (AV)</li><li>
Next Gen Anti-Virus (NGAV) o Endpoint Detection and Response (EDR)</li><li>
Sandboxing</li><li>
Virtual Machines o Netflow analysis</li><li>
Malware Repositories</li><li>
Threat Intelligence o Deception Stack</li><li>
Intrusion Detection/Prevention System (IDS/IPS)</li><li>
Security Orchestration Automation Response (SOAR)</li><li>
Phishing Triage o User Behavior Analytics (UBA)</li><li>
Email Hygiene and Filtering</li></ul></li><li>
Experience interfacing with peer support teams (Security Engineering, Vulnerability and Patching Teams, Networking, Access Management, Legal, Risk/Governance, etc.)</li><li>
Experience working in a high-tempo, dynamic environment with a high-performance team.</li><li>
Experience with work ticketing systems (e.g. &ndash; ServiceNow, JIRA).</li><li>
Experience with Threat Modeling and Kill Chain analysis.</li></ul>
Additional Information<ul><li>
Candidate must be located in or willing to relocate to the greater Nashville, TN area.</li><li>
12 hour rotating work schedule shifts.</li><li>
Nights and weekend shifts are included.</li><li>
Recruiter will talk further with you about the work schedule details.</li></ul>
<h5 class="jobSectionHeader">Benefits</h5>
HCA Healthcare, offers a total rewards package that supports the health, life, career and retirement of our colleagues. The available plans and programs include:<ul><li>
Comprehensive benefits for medical, prescription drug, dental, vision, behavioral health and telemedicine services</li><li>
Wellbeing support, including free counseling and referral services</li><li>
Time away from work programs for paid time off, paid family leave, long- and short-term disability coverage and leaves of absence</li><li>
Savings and retirement resources, including a 401(k) Plan with a 100% match on 3% to 9% of pay (based on years of service), Employee Stock Purchase Plan, flexible spending accounts, preferred banking partnerships, retirement readiness tools, rollover support and financial wellbeing counseling</li><li>
Education support through tuition assistance, student loan assistance, certification support, dependent scholarships and a partnership with Galen College of Nursing</li><li>
Additional benefits for fertility and family building, adoption assistance, life insurance, supplemental health protection plans, auto and home insurance, legal counseling, identity theft protection and consumer discounts</li></ul>
Learn more about Employee Benefits
Note: Eligibility for benefits may vary by location.
HCA Healthcare has been recognized as one of the World's Most Ethical Companies&reg; by the Ethisphere Institute more than ten times. In recent years, HCA Healthcare spent an estimated $3.7 billion in cost for the delivery of charitable care, uninsured discounts, and other uncompensated expenses.
&quot;Bricks and mortar do not make a hospital. People do.&quot;- Dr. Thomas Frist, Sr. 
HCA Healthcare Co-Founder
If you are looking for an opportunity that provides satisfaction and personal growth, we encourage you to apply for our Security Threat Engineer I opening. We promptly review all applications. Highly qualified candidates will be contacted for interviews. Unlock the possibilities and apply today!
We are an equal opportunity employer. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.</div>

Security Threat Engineer I

AES Corporation

<div>Are you ready to be part of a company that's not just talking about the future, but actively shaping it? Join The AES Corporation (NYSE: AES), a Fortune 500 company that's leading the charge in the global energy revolution. With operations spanning 14 countries, AES is committed to shaping a future through innovation and collaboration. Our dedication to innovation has earned us recognition as one of the Top Ten Best Workplaces for Innovators by Fast Company in 2022. And with our certification as a Great Place to Work, you can be confident that you're joining a company that values its people just as much as its groundbreaking ideas.
AES is proudly ranked #1 globally in renewable energy sales to corporations, and with $12.7B in revenues in 2023, we have the resources and expertise to make a significant impact as we provide electricity to 25 million customers worldwide. As the world moves towards a net-zero future, AES is committed to meeting the Paris Agreement's goals by 2050. Our innovative solutions, such as 24/7 carbon-free energy for data centers, are setting the pace for rapid, global decarbonization.
If you're ready to be part of a company that's not just adapting to change, but driving it, AES is the place for you. We're not just building a cleaner, more sustainable future - we're powering it. Apply now and energize your career with a true leader in the global energy transformation.
The AES Cyber Security Team is looking for a Cloud Security Engineer responsible for assisting in the maintenance and improvement of incident readiness and response efforts to defend our cloud environment. The individual in this position will work as a member of the Cyber Defense organization responsible for a variety of cybersecurity functions utilizing their understanding of cyber security practices and technologies.
The candidate should demonstrate the ability to conduct incident response activities with a focus on cloud platforms, recommend improvements to increase incident readiness posture, and design and document security playbooks and technical documentation to assist in maturing of the wider cloud security programs.
Responsibilities:<ul><li>
Detect, investigate, and respond to security incidents across the organization offering subject matter expertise in cloud security related incidents.</li><li>
Assist in the hands-on configuration, operation, monitoring, and continuous tuning of the Cloud Native Application Protection Platform (CNAPP).</li><li>
Create and maintain cloud security playbooks to include security automation, policy tuning, and incident response. Assist in the connection of cloud security tools with other threat and vulnerability management initiatives.</li><li>
Research, design, and test known tactics, techniques, and procedures used in cloud security attacks to validate effectiveness of security controls across the cloud environment.</li><li>
Assist in the approval and onboarding of new Software as a Service (SaaS) solutions in use by the organization. Ensure security controls are applied to new and existing SaaS solutions.</li></ul>
Required Skills:
<ul><li>3+ years of cyber security, systems administration, networking and/or cloud engineering experience.</li><li>
Excellent knowledge of the incident response process with experience in identifying, containing, and responding to cloud security incidents.</li><li>
Expert knowledge of enterprise-grade security technologies and capabilities (e.g. SIEM, DLP, EDR, IPS, Firewalls, Web Security, etc.)</li><li>
Strong knowledge of cloud security operations including tuning of logging and monitoring, Identity Access Management (IAM), and network security best practices.</li><li>
Hands-on experience configuring, managing, and operating Cloud Security Posture Management (CSPM) and/or Cloud Native Application Protection Platform (CNAPP) tools such as Prisma Cloud, Orca, Wiz, SentinelOne, Palo Alto, Tenable Cloud, or similar technologies.</li><li>
Excellent communication skills (verbal and written), including proficiency in English.</li><li>
Ability to work in an environment with evolving requirements and dynamic schedules.</li></ul>
Desired Skills:<ul><li>
Prior experience with red or purple team exercises in the scope of cloud assets and technologies.</li><li>
Prior experience with AWS, Azure, or Google Cloud.</li><li>
Prior experience with cyber security tools and capabilities for SaaS cloud applications.</li><li>
Prior experience with cyber security incident response.</li><li>
Security or Cloud Related Certifications is a plus</li><li>
Knowledge of the Spanish language is a plus.</li></ul>
Location: Arlington, VA or Indianapolis, IN. Eligible for relocation.
AES is an Equal Opportunity Employer who is committed to building strength and delivering long-term sustainability through diversity and inclusion. Respecting all backgrounds, differences and perspectives enables us to improve the lives of our people, customers, suppliers, contractors, and the communities in which we live and work. All qualified applicants will receive consideration for employment without regard to sex, sexual orientation, gender, gender identity and/or expression, race, national origin, ethnicity, age, religion, marital status, physical or mental disability, pregnancy, childbirth, or related medical condition, military or veteran status, or any other characteristic protected under applicable law. E-Verify Notice: AES will provide the Social Security Administration (SSA) and if necessary, the Department of Homeland Security (DHS) with information from each new employee's I-9 to confirm work authorization.</div>

Cloud Security Engineer

help AG

<div>Help AG is looking for a System Security Engineer responsible for managing endpoint security technologies, including EDR/XDR platforms, endpoint management, OS hardening, and security monitoring. The role involves implementing security controls, managing patching and device compliance, supporting incident response, and automating security operations using tools such as Microsoft Defender, Intune, and PowerShell. 
Responsibilities:<ul><li>
Administer and manage endpoint detection and response solutions including Microsoft Defender for Endpoint, CrowdStrike Falcon, and SentinelOne.</li><li>
Perform policy configuration, exclusions management, alert triage, and proactive threat hunting.</li><li>
Manage next-generation antivirus and exploit protection features such as Attack Surface Reduction (ASR), Controlled Folder Access, and exploit mitigation.</li></ul><ul><li>
Configure Windows Defender Firewall, web filtering, and endpoint device control policies (e.g., USB restrictions).</li><li>
Implement application control using AppLocker and Windows Defender Application Control (WDAC).</li><li>
Apply Windows security hardening based on CIS Benchmarks and Microsoft Security Baselines.</li><li>
Manage Group Policy (GPO) and ADMX configurations including local admin restrictions and Windows LAPS.</li></ul><ul><li>
Manage enterprise device lifecycle using platforms such as Microsoft Intune, Microsoft Endpoint Configuration Manager (SCCM/MECM), Jamf (macOS), and Workspace ONE.</li><li>
Support device provisioning, enrollment workflows, and Windows Autopilot deployments.</li></ul><ul><li>
Manage patching using Windows Update for Business, WSUS, and SCCM.</li><li>
Deploy and maintain third-party updates for applications such as Google Chrome, Java, and Adobe Acrobat.</li><li>
Package and deploy applications using MSI, MSIX, and Win32 formats via scripting or management tools.</li></ul><ul><li>
Work with identity services including Active Directory and Microsoft Entra ID.</li><li>
Configure Conditional Access policies and device compliance policies.</li><li>
Manage endpoint security features including BitLocker disk encryption, key escrow, and recovery processes.</li><li>
Implement credential protection mechanisms such as Credential Guard, LSASS protection, and disabling legacy protocols (e.g., SMBv1, NTLM where possible).</li><li>
Support certificate-based authentication using PKI fundamentals for device, Wi-Fi, and VPN authentication.</li></ul><ul><li>
Analyze endpoint telemetry from Windows Event Logs, Sysmon, and Microsoft Defender advanced hunting.</li><li>
Support incident response activities including host isolation, artifact collection, scanning, containment, and remediation.</li><li>
Conduct endpoint triage investigations involving processes, services, scheduled tasks, registry persistence, and system artifacts.</li><li>
Perform threat hunting using KQL queries and map findings to the MITRE ATT&amp;CK framework.</li></ul><ul><li>
Demonstrate understanding of networking concepts including TCP/IP, DNS, DHCP, and proxy configurations.</li><li>
Troubleshoot TLS/certificate issues, VPN client behavior, and split-tunneling impacts.</li><li>
Understand network requirements and firewall/proxy considerations for EDR and MDM communications.</li></ul><ul><li>
Develop automation scripts using PowerShell for device inventory, compliance validation, and remediation tasks.</li><li>
Integrate with APIs such as Microsoft Graph and EDR platform APIs for automation and reporting.</li><li>
Basic knowledge of Python scripting is considered an advantage.</li></ul>
Qualifications &amp; Skills
<ul><li>Bachelor&rsquo;s degree in Computer Science, Cybersecurity, Information Technology, or a related field.</li><li>
3&ndash;6+ years of experience in endpoint security, system security engineering, or cybersecurity operations.</li><li>
Hands-on experience with Microsoft security ecosystem including Defender, Intune, and Entra ID.</li><li>
Strong knowledge of endpoint protection technologies, device management, and security hardening practices.</li><li>
Experience with scripting (PowerShell required; Python is a plus).</li><li>
Familiarity with threat hunting, incident response, and endpoint forensic analysis.</li><li>
Preferred Certifications:
</li></ul><ul><li>CompTIA Security+</li><li>
Certified Ethical Hacker (CEH)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
Microsoft Security or Endpoint Management certifications</li></ul>
Benefits<ul><li>Health insurance with one of the leading global providers for medical insurance</li><li>Career progression and growth through challenging projects and work</li><li>Employee engagement and wellness campaigns and activities throughout the year</li><li>Excellent learning and development opportunities</li><li>Annual flight tickets</li><li>Inclusive and diverse working environment</li><li>Flexible / Hybrid working environment</li><li>Open Door Policy</li></ul>
About Us
Help AG is the cybersecurity arm of e&amp; enterprise (formerly Etisalat Digital) and provides leading enterprise businesses and governments across the Middle East with strategic consultancy combined with tailored information security services and solutions that address their diverse requirements, enabling them to evolve securely with a competitive edge.
Present in the Middle East since 2004, Help AG was strategically acquired by e&amp; (formerly Etisalat Group) in February 2020, creating a cybersecurity and digital transformation powerhouse in the region.
Help AG has firmly established itself as the region's trusted IT security advisor by remaining vendor-agnostic, trustworthy, independent, and cybersecurity focused. With best-of-breed technologies from industry-leading vendor partners, expertly qualified service delivery teams, and a state-of-the-art consulting practice, Help AG delivers unmatched value to its customers by strengthening their cyber defenses and safeguarding their businesses.</div>

System Security Engineer

Search 10000+ Incident response engineer jobs near you this March. New roles added regularly across leading industries. Apply today.