Information Security Engineer

TTEC is hiring an Information Security Engineer to investigate and respond to security alerts and threats across its technology environment. The role supports the SOC and Threat Management team through incident analysis, detection improvements, and coordination of containment and remediation.

Responsibilities:

• Investigate security alerts and threat hunting leads across a variety of technologies (SIEM, EDR, email security, cloud, etc) as part of the SOC and with the Threat Management team
• Maintain situational awareness of changes to threat landscape, industry trends, and internal operating environment. You’ll interact frequently with other members of the Information Security teams, internal IT Operations and Engineering teams, and vendor technical resources
• Correlate SIEM alerts with endpoint process activity, authentication events, email artifacts, network connections, and cloud audit logs to establish incident timelines, identify affected users and assets, and distinguish benign activity from suspected compromise
• Spend time understanding the environment you're responsible for and engage with various teams to gain further knowledge of the environment(s)
• Recognize potential, successful, and unsuccessful intrusion attempts and compromises through review and analysis of relevant event data
• Document incident severity, scope, supporting evidence, investigation steps, and recommended actions in case records. Follow approved response playbooks and escalation procedures, coordinate authorized containment and remediation with system owners, and validate recovery before closing incidents
• Document incident severity, scope, supporting evidence, investigation steps, and recommended actions in case records. Follow approved response playbooks and escalation procedures, coordinate authorized containment and remediation with system owners, and validate recovery before closing incidents
• Partner with the Threat Management team to develop, test, and refine detection queries and investigation playbooks
• Validate detections against relevant event data, investigate false positives, and document telemetry gaps and recommended improvements

Requirements:

• Hands-on SOC experience investigating and responding to security events across two or more of the following: SIEM, EDR, email security, NGFW, cloud platforms, threat intelligence
• Ability to investigate cloud security events by reviewing identity and access permissions, administrative activity, audit logs, and network access controls; identify suspicious authentication, privilege changes, and potentially unauthorized access to cloud resources
• Working knowledge of TCP/IP, DNS, HTTP/S, common network services, Windows and Linux security logs, and authentication and authorization concepts, with the ability to use this knowledge to interpret suspicious host, user, and network activity
• Strong communication and interpersonal skills
• Candidate will possess 2-3 years of experience in Information Systems or IT security-related functions
• Ability to use a scripting language to parse logs, enrich indicators, and automate repetitive investigation tasks, with appropriate validation, error handling, documentation, and protection of sensitive data
• IT degree and/ or training is very helpful