Position Summary
We are seeking a strategic and experienced Senior IT Security Engineer to lead our Security Operations Center (SOC) and drive our organization's cybersecurity excellence. You will play a critical leadership role in managing complex security incidents, designing vulnerability management strategies, overseeing security compliance frameworks, and mentoring our security team. With 6-8+ years of advanced hands-on security experience, deep expertise in incident response and threat investigation, proficiency with enterprise security platforms (Sophos Intercept X, Windows Defender, Proofpoint, ManageEngine), and a demonstrated track record of building secure infrastructure, you will help establish DataCore as a security leader. If you can think strategically about security architecture, lead incident response investigations, mentor junior analysts, and drive compliance initiatives across SOC 2 Type II, ISO 27001, and GDPR, we want to hear from you!
Duties & Responsibilities
Strategic & Leadership Responsibilities:
Lead the Security Operations Center (SOC) team, mentor junior and mid-level analysts, and establish best practices for incident response and threat detection
Design and implement security monitoring strategies, detection engineering capabilities, and alert tuning frameworks across Sophos, Proofpoint, Windows Defender, and ManageEngine
Develop and maintain security policies, procedures, runbooks, and playbooks for the organization; ensure alignment with SOC 2 Type II, ISO 27001, GDPR, and NIS2 requirements
Conduct security risk assessments and threat modeling; recommend security architecture improvements and infrastructure hardening initiatives
Serve as primary liaison with compliance teams; drive audit readiness activities and evidence collection for SOC 2, ISO 27001, and regulatory compliance programs
Evaluate, select, and manage security tools and vendor relationships; conduct cost-benefit analysis and ROI assessments for new security solutions
Lead incident response for complex, multi-stage security incidents; perform advanced root cause analysis and develop strategic remediation plans
Operational & Technical Responsibilities:
Monitor, detect, analyze, and respond to security incidents and alerts from Sophos Intercept X Advanced, Windows Defender, Proofpoint, and other security platforms with advanced investigation techniques
Conduct comprehensive vulnerability assessments and security scans using ManageEngine; establish prioritization frameworks based on business context and threat landscape
Investigate advanced threats, malware incidents, and suspected breaches; perform forensic analysis and produce detailed incident reports with executive summaries
Manage email security at scale; develop and enforce email security policies, investigate sophisticated phishing and BEC campaigns, and implement email authentication standards (SPF, DKIM, DMARC)
Perform threat hunting using MITRE ATT&CK framework; identify emerging threats and proactive security gaps before they are exploited
Collect, analyze, and report security metrics, KPIs, and incident trends to management; design security dashboards and executive-level security briefings
Support continuous improvement of security awareness and training programs; assess training effectiveness and adjust content based on threat landscape
Requirements
Essential Skills and Experience Required
Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or related field (or equivalent professional experience and demonstrated expertise)
6-8+ years of hands-on experience in IT Security, incident response, or security operations.
Advanced expertise in Security Operations Center (SOC) operations, incident response management, and threat investigation with demonstrated ability to lead complex investigations
Expert-level knowledge of operating systems (Windows Server, Linux) including security hardening, OS-level threat detection, and endpoint security architecture
Advanced understanding of networking concepts (TCP/IP, DNS, firewalls, VPN, proxies) and network security architecture; ability to design secure network segmentation
Deep understanding of attack vectors, attack chains, and the cyber kill chain; ability to map threats to MITRE ATT&CK framework and develop countermeasures
Expert hands-on experience with Sophos Central Intercept X Advanced or similar advanced EDR (Endpoint Detection and Response) solutions; demonstrated ability to configure, tune, and leverage advanced EDR capabilities
Expert experience with Windows Defender for Endpoint and/or other enterprise antivirus/anti-malware solutions at scale
Expert-level knowledge of email security; deep experience with Proofpoint or similar enterprise email security platforms; proficiency in email authentication protocols (SPF, DKIM, DMARC, BIMI)
Expert-level experience with vulnerability scanning and management tools, preferably ManageEngine; demonstrated ability to design vulnerability management programs, prioritize remediation, and track metrics
Advanced expertise in SIEM tools and log analysis; proven ability to design SIEM architectures, develop correlation rules, and build security use cases
Demonstrated expertise in compliance frameworks (SOC 2 Type II, ISO 27001, GDPR, NIS2); experience leading compliance assessments and audit preparations
Expert-level analytical and problem-solving skills with ability to think strategically about security architecture and long-term security posture
Exceptional communication skills; ability to present technical security findings to executive leadership and non-technical stakeholders; strong written and verbal communication
Proven ability to mentor and develop junior security analysts; experience building and scaling security teams
Leadership experience managing security incidents and coordinating response across multiple teams
Preferred Skills and Certifications
Advanced security certifications such as CISSP (Certified Information Systems Security Professional)
CompTIA Security+ or equivalent foundational certifications
Advanced experience with threat intelligence platforms, threat research, and intelligence-driven security operations
Advanced scripting skills (PowerShell, Python, Bash) for security automation, SIEM rule development, and workflow optimization
Advanced cloud security expertise (Azure, AWS); demonstrated ability to design and secure cloud infrastructure; knowledge of cloud-native threat detection
Experience with SOAR (Security Orchestration, Automation and Response) platforms and advanced automation of incident response workflows
Incident response leadership; experience as incident commander or on incident response teams for critical incidents
Security architecture and design expertise; experience building or redesigning security infrastructure
Experience with GRC (Governance, Risk, Compliance) platforms and compliance automation
Vendor management experience; track record of evaluating, negotiating, and managing security tool contracts
Threat hunting expertise and experience with advanced threat hunting methodologies
