[Hiring] SOC Detection and Response - Engineer Cyber Security Engineer @Unisys

Role Description

Identifies potential network, system and information vulnerabilities. Develops and implements solutions to mitigate risks and enhance system security. Provides consultation to organizations on security issues. Performs security investigation and computer forensic analysis. Performs penetration testing, security-focused system architecture review, incident response planning and execution. Identifies potential vulnerabilities and gaps in the Software Development Life Cycle working with the Engineering and Product teams as they build products and solutions.

Key Responsibilities/Outcomes

• Security Monitoring and Incident Investigation
  • Monitor and triage security alerts generated by SIEM, EDR, IDS/IPS, email security, identity protection, cloud security, and other security monitoring platforms.
  • Perform initial investigation and enrichment activities to determine alert validity, scope, and potential business impact.
  • Analyze endpoint, network, identity, and cloud security telemetry to identify indicators of compromise and suspicious activity.
  • Escalate complex, high-severity, or confirmed security incidents to senior analysts and incident responders in accordance with established procedures.
  • Assist with containment and response activities under the direction of senior analysts and incident response personnel.
  • Manage assigned investigations through completion, including evidence collection, analysis, documentation, and timely escalation when required.
• Threat Detection and Analysis
  • Participate in structured threat hunting activities led by senior analysts to identify potential threats and develop investigative skills.
  • Use frameworks such as MITRE ATT&CK to understand adversary tactics, techniques, and procedures.
  • Assist with the review and validation of emerging threats, indicators of compromise, and detection opportunities.
  • Identify recurring alert patterns and recommend opportunities to improve detection quality and reduce false positives.
• Security Operations and MSSP Collaboration
  • Collaborate with MSSP analysts and internal teams to review alerts, investigations, and case outcomes.
  • Review MSSP-generated alerts and reports, escalating discrepancies or quality concerns through established processes.
  • Support operational activities related to security monitoring, alert management, and investigation workflows.
• Security Automation and Process Support
  • Support the maintenance and testing of security automation workflows and SOAR playbooks.
  • Identify opportunities to improve investigation efficiency, alert handling, and response processes.
  • Follow established investigation playbooks, escalation procedures, and operational standards.
• Documentation and Continuous Improvement
  • Maintain accurate, complete, and audit-ready documentation of investigations, incident response actions, and case outcomes.
  • Ensure case updates, evidence, and findings are properly recorded within case management platforms.
  • Stay current on cybersecurity threats, vulnerabilities, attack techniques, and industry trends.
  • Participate in team knowledge sharing, training, and continuous improvement initiatives.

Qualifications

• Any degree with 2-3 years of experience working in a Security Operations Center (SOC), Managed Security Services Provider (MSSP), Incident Response, or similar cybersecurity environment.

Requirements

• Experience working in a Security Operations Center (SOC), Managed Security Services Provider (MSSP), Incident Response, or similar cybersecurity environment.
• Working knowledge of Security Information and Event Management (SIEM) platforms and security monitoring concepts.
• Experience investigating alerts generated from Endpoint Detection and Response (EDR) platforms.
• Foundational understanding of Windows, Linux, identity services, and enterprise security concepts.
• Understanding of network security fundamentals, common protocols, and traffic analysis concepts.
• Familiarity with cybersecurity frameworks and methodologies such as MITRE ATT&CK.
• Foundational understanding of cloud security concepts and identity-based threats.
• Strong analytical skills with the ability to identify anomalies, patterns, and indicators of malicious activity.
• Ability to perform structured investigations and make sound decisions using available evidence.
• Strong attention to detail and commitment to high-quality documentation.
• Strong verbal and written communication skills.
• Ability to work effectively within a global cybersecurity team and collaborate with technical and non-technical stakeholders.
• Ability to follow established processes while adapting to changing operational priorities.

Preferred Qualifications

• Experience with Google SecOps, CrowdStrike Falcon, Microsoft Defender, Splunk, or similar technologies.
• Exposure to SOAR platforms and security automation concepts.
• Basic scripting experience using Python, PowerShell, or Bash.
• Exposure to threat hunting, digital forensics, malware analysis, or incident response activities.
• Industry certifications such as Security+, CySA+, SC-200, GSEC, or equivalent.