Global Security Operations Engineer

Dentons

. Serve as a senior escalation point for complex, ambiguous, and high-severity security incidents .

Posted 11/3/2026full-timeRemote • Australia, Hong KongMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in security operations and incident response, with a strong focus on leading complex investigations, developing automated response playbooks, and applying the MITRE ATT&CK framework. Proficient in scripting and automation, with the ability to communicate technical findings effectively to diverse audiences.

Highest-signal resume keywords

Security Operations Center (SOC) ExperienceIncident Response LeadershipAutomation and Scripting ProficiencyMITRE ATT&CK Framework KnowledgeHost and Network Forensics Expertise

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseRoot Cause AnalysisMalware TriageKQLPowerShellPythonTCP/IP NetworkingActive DirectoryCloud SecurityForensics

Soft Skills

Strong Communication SkillsCollaborationIndependent WorkFlexibility

Tools & Technologies

SIEM PlatformsEndpoint Detection and Response (EDR)Microsoft SentinelMicrosoft Defender XDRMicrosoft Entra IDLogic AppsSOAR Workflows

Certifications & Qualifications

GCIHGCIAGCFAGREMOSCPCySA+SC-200AZ-500CISSP

Industry Keywords

Cybersecurity FrameworkISO 27001NIST Cybersecurity FrameworkCyber Kill ChainPICERL

Tech Stack

Tools & technologies

AzureCloudCyber SecurityLinuxPythonTCP/IP

About the role

Key responsibilities & impact

Serve as a senior escalation point for complex, ambiguous, and high-severity security incidents
Conduct detailed investigations into initial access vectors, attacker activity, objectives, compromise scope, and dwell time
Perform root cause analysis on confirmed incidents and near misses
Lead significant incidents through containment, eradication, and recovery across global and regional teams
Conduct host and network forensics and malware triage
Translate technical findings into business-risk statements and drive post-incident corrective actions to closure
Investigate identity-based attacks, account compromise, unauthorized access, and suspicious activity across cloud platforms and enterprise applications, including Microsoft 365 and Entra ID
Participate in an on-call rotation and provide out-of-hours escalation support
Design, build, tune, and maintain MITRE ATT&CK-mapped detection content
Reduce false positives through tuning, suppression logic, and automated alert enrichment
Translate threat intelligence into detections, threat-hunting hypotheses, and preventive controls
Design and maintain automated response playbooks using Logic Apps, automation rules, and SOAR workflows
Write and maintain KQL, PowerShell, Python, or equivalent queries, scripts, and code
Integrate security tooling and data sources through APIs and connectors, including onboarding and validating new log sources
Improve security monitoring, detection, response, automation, and technology optimization
Apply AI-assisted investigation, alert triage, and security automation capabilities
Conduct proactive threat hunting to identify suspicious activity and validate detection effectiveness
Work closely with global and regional technology and security teams and provide technical leadership during significant incidents

Requirements

What you’ll need

5+ years of experience in security operations, incident response, or detection engineering, including demonstrable experience working in a Security Operations Center (SOC)
Proven experience leading complex technical investigations end to end, from escalation through root cause analysis to documented remediation
Deep, hands-on expertise with modern SIEM and endpoint detection and response (EDR) platforms, including authoring and optimizing detection logic, conducting investigations, and managing data onboarding
Strong practical automation and scripting abilities, including KQL and at least one of PowerShell or Python, with demonstrated experience developing and operating automation in production
Experience designing and maintaining automated response playbooks using Logic Apps, automation rules, or comparable SOAR capabilities
Advanced knowledge of the MITRE ATT&CK framework, Cyber Kill Chain analysis, and established incident response methodologies, such as PICERL
Strong working knowledge of TCP/IP and networking, Windows and Linux operating systems, Active Directory, Entra cloud identity and authentication, and security operations across cloud and hybrid environments
Experience with host and network forensics, malware triage, and the analysis of malicious email headers, links, and attachments
Strong written and verbal communication skills, including the ability to communicate technical findings and security risks to both technical and nontechnical audiences
Ability to work independently and collaborate effectively with geographically dispersed teams, with flexibility to provide out-of-hours support during significant security incidents
Occasional travel to support global cybersecurity operations and incident response may be required
Bachelor's degree in Information Security, Information Technology, Computer Science, or a related discipline, or equivalent professional experience (preferred)
Industry certifications such as GCIH, GCIA, GCFA, GREM, OSCP, CySA+, SC-200, AZ-500, or CISSP (preferred)
Hands-on experience with Microsoft security technologies, including Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID, and Microsoft Azure (preferred)
Experience operating within a global, federated, or shared-services model, ideally in professional services or another highly regulated sector (preferred)
Familiarity with ISO 27001, the NIST Cybersecurity Framework, or comparable control frameworks (preferred)

Benefits

Comp & perks

Benefits are aligned with the respective location.