Security Engineer III (EDR) - IN

Overview

Senior Security Engineer role focused on Rackspace Managed Endpoint Detection & Response (EDR) services, acting as L3 escalation and subject-matter expert for endpoint security operations.

What you'll do

• Ensure the customer's operational and production environment remains healthy and secure at all times.
• Assist with customer onboarding, including customer/device onboarding, policy configuration, platform configuration and service transition to security operations team(s).
• Advance platform administration.
• Handle and close critical platform incidents.
• Act as SME, L3 escalation and point of contact for SecOps Analysts during incident response.
• Act as a champion and centre of enablement by delivering training, coaching and thought leadership across Endpoint Security and EDR.
• Develop and document runbooks, playbooks and knowledgebase articles that drive best practice across teams.
• Drive continuous improvement of Rackspace Managed EDR services through custom development, automation and integration, in collaboration with SecOps Engineering and other Security Engineering teams.
• Maintain close working relationships with relevant teams and key stakeholders, such as incident response and disaster recovery teams and information security.
• Co-ordinate with vendors for issue resolution.

What you'll need

• 8+ years of experience in Security Engineering.
• Experience working in large enterprise environments or managed security services environments with a focus on Endpoint Detection & Response.
• Experience with cloud native Endpoint Security and EDR tools such as CrowdStrike, Microsoft Defender for Endpoint and/or Microsoft Defender for Cloud.
• Experience working in two (or more) of the following additional security domains: SIEM platforms such as Microsoft Sentinel, Google Chronicle, Splunk, QRadar, LogRhythm, Securonix etc.; or AWS Security Hub including AWS GuardDuty, AWS Macie, AWS Config and AWS CloudTrail.
• Experience analysing malware and email headers, with skills in network security, intrusion detection and prevention systems, operating systems, risk identification and analysis, threat identification and analysis, and log analysis.
• Experience with security controls such as network access controls, identity, authentication and access management controls (IAAM), and intrusion detection and prevention controls.
• Knowledge of security standards such as NIST, ISO27001, CIS, OWASP and Cloud Controls Matrix (CCM) etc.
• Knowledge of scripting and coding with languages such as Terraform, Python, JavaScript, Golang, Bash and/or PowerShell.
• Knowledge of malware reverse engineering, threat detection and threat hunting.
• Holds one or more of the following certificates (or equivalent): Microsoft Certified: Azure Security Engineer Associate (AZ-500); Microsoft Certified: Security Operations Analyst Associate (SC-200); Systems Security Certified Practitioner (SSCP); Certified Cloud Security Professional (CCSP); GIAC Certified Incident Handler (GCIH); GIAC Security Operations Certified (GSOC); CrowdStrike admin certified.
• Highly self-motivated and proactive, with attention to detail.
• Strong analyser, troubleshooter and problem solver who understands security operations, programming languages and security architecture.
• Highly organised and detail oriented, with the ability to prioritise, multitask and work under pressure.
• Willingness to go above and beyond in delighting the customer.
• Good communicator who can explain security concepts to both technical and non-technical audiences.

Nice to have

• Experience with Microsoft Sentinel as a SIEM platform (preferred).

Details

• Location: Gurgaon, India.
• Required to work flexible timings.
• Computer science, engineering, or information technology related degree (although not a strict requirement).