Security Operations Engineer

Role overview

Help protect an organization’s people, systems and information by investigating security alerts and supporting incident response across identity, endpoint, email, SaaS and cloud environments. You’ll handle routine investigations through to documented outcomes, while learning from experienced responders on complex incidents and helping improve detection and response workflows.

Responsibilities

- Triage alerts using established tools, runbooks and escalation procedures, and investigate suspicious activity across relevant systems. - Gather evidence, build event timelines, assess findings and document conclusions, including any uncertainty. - Support major incident response with evidence collection, technical analysis, and agreed containment or recovery steps. - Keep investigation records current and provide clear updates and handovers across teams and time zones. - Improve runbooks and detection quality, and contribute small scripts or automated workflows with review. - Participate in post-incident reviews and turn lessons into practical operational changes.

Requirements

- Hands-on experience investigating security alerts in a security operations, incident response or similar role. - Experience with a SIEM, endpoint detection and response, email security or comparable investigation tools. - Understanding of common threats such as phishing, account compromise and suspicious endpoint activity, plus relevant networking, operating system and identity concepts. - Ability to query and interpret logs, separate evidence from assumptions, and recognize when to investigate further or escalate. - Ability to read, adapt and write small scripts in Python or another language. - Clear written and verbal communication, careful handling of sensitive information, and openness to feedback.

Nice to have

- Exposure to cloud platforms, SaaS applications or identity systems; detection tuning, threat hunting or cross-source investigations; workflow automation; or forensic evidence collection on macOS, Windows or Linux.

Benefits and work setup

Work arrangements may be remote, hybrid or office-based depending on operational needs and the position’s location requirements. The listing also describes health and parental leave plans and a professional development stipend.