Security Engineer

NetCyberOps is a cybersecurity services company dedicated to delivering high-quality security solutions to clients and partners. The Security Engineer will handle escalated investigations, maintain and improve customer security tooling environments, develop threat detection logic, and lead proactive threat hunting activities.

Responsibilities:

• Handle escalated investigations from SOC analysts, providing deeper analysis and final disposition
• Ensure customer security tooling environments (EDR, SIEM, and related platforms) are configured correctly and functioning as intended
• Troubleshoot tooling issues and manage change requests and upgrades across customer environments
• Design, build, and tune threat detection logic to improve detection coverage and reduce false positives
• Conduct proactive threat hunting and lead threat hunting exercises with SOC analysts
• Interact with customers and partners on technical escalations, tooling changes, and threat findings
• Continuously evaluate and improve tooling, detection content, and SOC processes

Requirements:

• Strong understanding of digital signatures, file hashes, and encryption and encoding principles
• Ability to read, write, and troubleshoot scripts (e.g., Python, PowerShell, Bash)
• Solid knowledge of operating system internals, antivirus/EDR functioning, and virtualization
• Strong networking knowledge, including TCP/UDP/ICMP protocols, DNS, and packet-level analysis
• Advanced Windows expertise, including Active Directory, system processes, and common attack paths
• Working knowledge of Linux administration, including SSH and shell usage
• Solid understanding of malware classifications, behaviors, and identification techniques
• Hands-on experience configuring, tuning, and troubleshooting EDR and SIEM platforms required
• Experience with detection engineering (writing and tuning correlation rules, signatures, or detection logic)
• Experience conducting or leading threat hunting exercises
• Familiarity with change management processes for production security tooling
• Strong technical communication abilities, including the ability to explain technical decisions to both analysts and customers
• Ability to write clear technical documentation, including tooling configuration guides and detection logic write-ups
• Capability to lead customer conversations regarding tooling issues, escalations, and threat findings
• Professionalism in all aspects of work
• Strong critical thinking, root-cause analysis, and problem-solving skills
• Comfortable mentoring and guiding SOC analysts, including during escalations and hunting exercises
• Ability to manage multiple customer environments and competing priorities
• A strong drive to stay current with emerging threats and tooling capabilities
• A degree in a relevant field (e.g., Computer Science, Information Technology) or equivalent practical experience
• 3+ years of experience in a SOC, security engineering, or related cybersecurity role
• Relevant certifications (e.g., CompTIA Security+, GCIH, GCIA, or vendor-specific EDR/SIEM certifications) are a plus