Ensign is hiring !
Key Responsibilities:
- Lead investigation and incident response activities for high-severity or complex security incidents across multiple clients.
- Act as final escalation point for incidents unresolved by Tier 1 and Tier 2 analysts.
- Conduct advanced forensic analysis of logs, network traffic, endpoints, and malware to identify root cause and scope.
- Perform proactive threat hunting based on current threat intelligence, TTPs (MITRE ATT&CK), IOCs, and anomalous behavior.
- Develop and refine detection logic, SIEM correlation rules, and EDR/NDR signatures to enhance SOC effectiveness.
- Support incident containment, eradication, and recovery efforts across diverse client environments.
- Collaborate with Threat Intelligence, Engineering, and IR teams to improve tools, data sources, and workflows.
- Identify gaps in an organization’s measurement metrics, telemetry, and logging capabilities and propose enhancement strategies to achieve the intended outcomes.
- Provide technical leadership and mentorship to junior analysts, supporting their skill development and analysis quality.
- Conduct post-incident reviews and create root cause analysis (RCA) and after-action reports for clients.
- Contribute to playbook creation, tuning, and automation efforts, particularly within SOAR platforms.
- Interface with client security teams, IT teams, and executives to communicate investigation findings, remediation guidance, and strategic improvements.
- Ensure SOC processes align with industry frameworks (e.g., NIST, ISO 27001) and client-specific regulatory requirements (e.g., HIPAA, PCI-DSS).
- Lead purple team exercises or internal red vs. blue simulations to test detection coverage and SOC readiness.
Requirements:
Education & Experience:
- Bachelor’s degree in Cybersecurity, Computer Science, or related discipline (or equivalent hands-on experience).
- 4+ years of experience in a SOC or cybersecurity operations role, including experience with incident response and threat hunting.
- Prior experience in an MSSP or multi-tenant SOC environment is strongly preferred.
Technical Skills:
- Deep expertise in security tools: SIEM (e.g., Splunk, MS Sentinel, QRadar, Google SecOps, Devo), EDR (e.g., CrowdStrike, SentinelOne), NDR, SOAR.
- Strong understanding of malware behavior, exploit techniques, persistence mechanisms, and attack chain.
- Advanced knowledge of operating systems (Windows/Linux), networking, firewalls, and cloud security (e.g., Azure, AWS).
- Familiarity with threat modeling, ATT&CK framework, cyber kill chain, and detection engineering.
- Experience with scripting and automation (e.g., Python, Bash, PowerShell) to improve SOC efficiency.
Certifications (preferred):
- GIAC certifications (e.g., GCIH, GCFA, GCIA, GDAT, GNFA)
- Offensive Security (OSCP) or equivalent
- CompTIA CASP+, CySA+
- Microsoft SC-200, Azure Defender certifications
Key Competencies:
- Strong investigative and analytical skills with attention to detail.
- Ability to manage multiple critical incidents and prioritize effectively under pressure.
- Excellent verbal and written communication, especially in client-facing contexts.
- Leadership and mentoring abilities to upskill junior staff and strengthen SOC maturity.
- Strategic thinking with a continuous improvement mindset.
- High degree of professionalism, discretion, and accountability.
Shift Expectations:
- Generally operates in a regular business-hour schedule, but must be available for escalation during critical incidents.
- May participate in on-call rotations or emergency response shifts depending on client SLAs.
Career Path:
Progression into roles such as SOC Team Lead, Incident Response Manager, Threat Intelligence Lead, or Security Architect, based on leadership, innovation, and impact.
