Lead Cybersecurity Engineer

About the Company

Responsibilities

• ● Lead the design, engineering, deployment, and continuous improvement of enterprise security tools and platforms, including EDR, SIEM, IDS/IPS, MDM, and Microsoft 365 security solutions.
• ● Architect and implement scalable security controls to protect endpoints, networks, cloud workloads, identity systems, and business-critical infrastructure.
• ● Manage and optimize integrations across security platforms, including EDR, SIEM, SOAR, MDM, IAM, and related monitoring tools.
• ● Drive incident detection and response engineering through alert tuning, detection use case development, correlation logic, and automation playbooks.
• ● Oversee deployment and enforcement of endpoint security controls, including DLP, USB/device control, device compliance policies, and endpoint hardening standards.
• ● Collaborate with SOC, Infrastructure, IAM, Cloud, and application teams to ensure security controls are implemented, monitored, and operationalized effectively.
• ● Lead troubleshooting and root cause analysis for security events, tool failures, policy issues, log ingestion gaps, and control effectiveness concerns.
• ● Establish and maintain SIEM use cases, correlation rules, dashboards, reports, and operational metrics to improve monitoring and executive visibility.
• ● Conduct vulnerability assessments, validate scan results, support remediation planning, and track risk reduction activities through closure.
• ● Participate in change management processes to assess security impact, define control requirements, and ensure security tooling remains aligned with approved changes.
• ● Drive automation initiatives using PowerShell, Python, SOAR workflows, and other scripting methods to reduce manual effort and improve response consistency.
• ● Develop and maintain security baselines, hardening standards, deployment playbooks, operational guides, and technical documentation.
• ● Monitor emerging threats, threat intelligence, and adversary techniques to adapt detections and controls based on current attack trends.
• ● Provide technical leadership, coaching, and mentorship to junior engineers, SOC analysts, and cross-functional teams.
• ● Technical Responsibilities
• ● Engineer, deploy, and administer EDR platforms such as CrowdStrike and Microsoft Defender for Endpoint, including policy tuning, threat detection, response actions, and control validation.
• ● Implement and manage SIEM platforms such as CrowdStrike NG SIEM or Splunk, including log onboarding, parsing, normalization, dashboarding, and advanced correlation logic.
• ● Design, implement, and support IDS/IPS and network security monitoring solutions to improve threat visibility, prevention, and investigation capability.
• ● Administer and optimize Microsoft 365 Security capabilities, including Microsoft Defender Suite, Entra ID, Conditional Access, Secure Score improvements, and identity protection controls.
• ● Manage MDM platforms such as Microsoft Intune or equivalent solutions for device compliance, device posture, policy enforcement, and access control.

Requirements

• ● Relevant certifications such as CISSP, CISM, CCSP, GCIH, GCIA, GCFA, CEH, Microsoft Security certifications, CrowdStrike certifications, Splunk certifications, or equivalent practical experience.
• ● Success Measures
• ● Improved security control coverage across endpoint, network, identity, cloud, and Microsoft 365 environments.
• ● Reduced alert noise and stronger detection quality through tuning, correlation improvements, and validated use cases.
• ● Reliable operationalization of security tools with clear playbooks, dashboards, reporting, and ownership.
• ● Improved audit readiness through documented configurations, evidence collection, baselines, and control validation.
• ● Increased automation and reduced manual effort in SOC triage, investigation, and response activities.