[Hiring] Security Engineer @First Advantage Global operating Centre

Role Description

The Security Engineer is an intermediate technical individual contributor who investigates and resolves Level 2 and Level 3 SOC escalations, develops and tunes detections, builds approved automation, and contributes to SOC engineering projects. The role applies general knowledge of industry practices, techniques, standards, concepts, and principles to technical problems of moderate scope and complexity.

• Investigate and resolve Level 2 and Level 3 alerts, cases, and incidents using established procedures, playbooks, and escalation paths.
• Analyze endpoint, identity, email, cloud, network, and application telemetry to validate activity, determine scope, and document findings.
• Develop, test, deploy, tune, and document detections for defined use cases across SIEM, XDR, EDR, cloud, identity, email, and other telemetry.
• Develop approved enrichment, triage, notification, containment, and remediation workflows for Tier 1 scenarios that outsourced providers cannot fully address.
• Perform scoped threat hunts and retrospective searches using documented hypotheses and established analysis methods.
• Support telemetry onboarding, platform configuration, integrations, and troubleshooting for assigned systems and use cases.
• Maintain accurate case records, detection documentation, automation runbooks, and technical procedures.
• Contribute to project milestones and escalate work that exceeds established authority, procedures, or technical scope.
• Monitor and investigate security events generated from SaaS applications, PaaS platforms, APIs, web applications, and database services, and develop detections, enrichment logic, and response workflows to improve visibility into application-layer threats and unauthorized data access.

Qualifications

• General knowledge of security operations, incident response, detection engineering, and common attacker techniques.
• Hands-on experience with SIEM, EDR/XDR, SOAR, or comparable security technologies.
• Experience using KQL, SPL, SQL, or a comparable query language.
• Foundational experience with PowerShell, Python, APIs, or comparable automation technologies.
• Ability to document technical findings clearly and exercise sound escalation judgment.
• Experience investigating endpoint, identity, email, cloud, network, or application security activity and preserving clear evidence of analysis.
• Working understanding of incident classification, escalation, containment, remediation, and recovery practices.
• Ability to use established engineering standards, peer review, source control, testing, and controlled deployment processes.
• Ability to balance concurrent incidents and engineering work, communicate status, and request guidance when scope or authority is exceeded.

Requirements

• Bachelor + 2 years; Master + 0 years; PhD + 0 years; or equivalent. Relevant equivalent knowledge or work experience may be considered in accordance with the FA Technical Leveling definitions.

Preferred Qualifications

• Hands-on experience with Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, Azure, AWS, or Microsoft 365.
• Experience working with an outsourced SOC, MDR, MSSP, or managed threat hunting provider.
• Experience creating security rules, playbooks, automation workflows, response actions, dashboards, or operational metrics.
• Relevant certifications such as SC-200, Security+, CySA+, AZ-500, or equivalent.

Measures of Success

• Accurate and timely resolution of assigned Level 2 and Level 3 escalations.
• Reliable detections and automations delivered in accordance with team standards.
• Reduction in repetitive Tier 1 escalations through approved playbooks and automation.
• Complete and usable case, detection, and workflow documentation.