Principal Security Engineer

Act as the primary technical owner for our SIEM solution. Lead the integration, log source onboarding, and continuous fine-tuning of detection rules and alerts in collaboration with our partners . Manage partner relationship s , including service delivery, budget, and performance metrics.

Design and implement a comprehensive monitoring strategy to ensure visibility across all critical environments, including our cloud service providers (AWS, Azure, GCP) and corporate networks.

Own and manage the security operations tool stack, including Extended Detection and Response ( X DR), Security Orchestration, Automation, and Response, and other detection technologies.

Lead and manage the end-to-end incident response lifecycle for all security incidents, from initial detection and triage to containment, eradication, and recovery, ensuring minimal impact on the business.

Develop, document, and maintain a library of incident response playbooks for various scenarios (e.g., malware, ransomware, phishing, data exfiltration, cloud security incidents).

Develop and execute proactive, intelligence-driven threat hunts to identify malicious actors and TTPs that evade traditional security controls.

Integrate and operationalize threat intelligence to enrich security alerts, inform detection strategies, and guide proactive security efforts.

Build and mature the company-wide Incident Response program, including defining policies, procedures, and communication plans.

Develop and lead incident response training, including conducting regular tabletop exercises and purple team assessments with stakeholders from IT, Engineering, Legal, and Communications.

Define and report on key security metrics (e.g., Mean Time to Detect, Mean Time to Respond) to leadership. Conduct post-mortem reviews and ensure remediation actions are tracked to completion.