FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in incident response, threat detection, and security event management, with a strong focus on automation and compliance with industry standards such as NIST and GDPR. Proficient in leveraging advanced tools and frameworks for proactive threat hunting and incident triage in multi-tenant environments.
Highest-signal resume keywords
Incident Response ManagementThreat Detection EngineeringSecurity Framework ComplianceAutomation and ScriptingCloud Security Architecture
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Incident CommandThreat HuntingCustom Correlation RulesPython ProgrammingNode.js DevelopmentGo ProgrammingMachine Learning OptimizationLog AnalysisAPI IntegrationSOAR Playbook Design
Soft Skills
LeadershipAnalytical ThinkingCommunication
Tools & Technologies
SIEMXDREDRAWSAzureGCPWiresharkSplunkDemistoGitHub Copilot
Certifications & Qualifications
GCIHGMONGNFACySA+CASP+OSCPCISSP
Industry Keywords
NIST SP 800-61r2MITRE ATT&CKGDPRISO/IEC 27001:2022Cyber Kill ChainSigma RulesMSSPSOCTelemetryIncident Notification
Tech Stack
Tools & technologiesAWSAzureBigQueryCloudDNSDockerGoogle Cloud PlatformJavaScriptNode.jsPandasPythonSplunkGo
About the role
Key responsibilities & impact- Lead operational triage, analysis, and prioritization of complex security events across multi-tenant client environments
- Serve as Incident Commander during critical security events
- Execute containment, eradication, and recovery strategies according to NIST SP 800-61r2
- Lead proactive threat hunting and detection engineering using MITRE ATT&CK
- Write custom correlation rules such as Sigma and YARA
- Ensure incident notifications and responses meet contractual SLAs and regulatory reporting timelines
- Extend the MSSP application backend with production-grade Python, Node.js, or Go code
- Build integrations for EDR, DNS security, threat intelligence, spam/phishing, identity management, firewall, and IDS telemetry
- Design SOAR playbooks for dynamic triage, identity enrichment, and automatic tenant isolation
- Implement LLM-based alert summarization and enrichment using Gemini, BigQuery, REST webhooks, RAG pipelines, and MCP servers
- Optimize detection pipelines with machine learning and AI filters to reduce false positives
- Align monitoring controls with NIST CSF 2.0, ISO/IEC 27001:2022, and NIST SP 800-53r5
- Ensure incident response and telemetry collection comply with GDPR, Brazil LGPD, and US state privacy laws
Requirements
What you’ll need- Experience in at least one platform or tool in each required category: SIEM/XDR, network/telemetry, AI/automation, SOAR/scripting, threat frameworks, and cloud environments
- SIEM/XDR experience with Splunk, Microsoft Sentinel, Elastic SIEM, CrowdStrike Falcon, SentinelOne, or Palo Alto Cortex XDR
- Network and telemetry experience with Wireshark, Zeek, Suricata, PCAP analysis, Syslog, Windows Event Logs, or CloudTrail/CloudWatch
- AI and automation experience with Python (Pandas, Requests), REST APIs, Cursor IDE, GitHub Copilot, Claude/OpenAI APIs, LangChain, Webhooks, or Docker
- SOAR and scripting experience with Python, PowerShell, Bash, Demisto/Cortex XSOAR, Shuffle, or Tines
- Knowledge of MITRE ATT&CK, NIST SP 800-61r2, Cyber Kill Chain, YARA, and Sigma Rules
- Experience with AWS, Azure, or GCP security architectures, IAM, and log architectures
- 3+ years in a SOC or MSSP environment preferred
- 2+ years in a Level 3 / Lead SOC capacity preferred
- Hands-on scripting and API integration experience to build automated incident response playbooks
- Proficiency with AI-assisted coding tools such as Cursor or Copilot
- Expertise in log analysis across endpoint, identity, network, and multi-cloud environments
- At least one required certification: GCIH, GMON, GNFA, CySA+, CASP+, or OSCP
- CISSP preferred
Benefits
Comp & perks- Equal employment opportunity and anti-discrimination protections
- Interview process includes a work style survey, hiring coordinator screen, manager interview, peer interview, and senior leadership interview
- Decision typically provided within one week after interviews