Support the integration of new systems, applications, cloud platforms, and security technologies into the security monitoring environment.
Work with technologies such as Exabeam, CrowdStrike, Wiz, and other security monitoring and cloud security platforms.
Support vulnerability management activities, including analysis, dashboards, reporting, and identification of meaningful security trends.
Develop and improve security dashboards and reporting to reduce manual effort and provide useful information to technical teams and leadership.
Assist with security incident investigations, including collection and analysis of relevant logs and security telemetry.
Participate in the development and execution of incident response tabletop exercises and other security preparedness activities.
Work collaboratively with other members of the Security Operations team, sharing technical knowledge and helping improve team processes and capabilities.
Identify opportunities to improve security operations and take ownership of improvements from initial problem identification through implementation and validation.
Maintain appropriate documentation for detection logic, monitoring coverage, investigations, and operational procedures.
Required Qualifications
Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, or a related field.
4+ years of hands-on experience in security operations, security monitoring, incident detection and response, vulnerability management, or a related information security discipline.
Strong hands-on experience in security operations, security monitoring, or incident detection and response.
Experience working with SIEM platforms, including investigating alerts and developing or tuning detection and correlation rules.
Understanding of Windows, endpoint, network, application, cloud, and security log sources.
Ability to analyze security events and distinguish legitimate activity, false positives, and potentially malicious behavior.
Experience with endpoint detection and response (EDR) technologies such as CrowdStrike or equivalent platforms.
Understanding of vulnerability management and experience working with vulnerability management or cloud security platforms.
Working knowledge of common security concepts, including threat detection, incident response, identity and access management, network security, endpoint security, and cloud security.
Ability to independently investigate technical issues and drive them through resolution.
Strong written and verbal communication skills, including the ability to explain technical security issues clearly to both technical and non-technical audiences.
Ability to work effectively across technical teams and collaborate with infrastructure, application, cloud, and security personnel.
Preferred Qualifications
Experience with Exabeam or another enterprise SIEM or security analytics platform.
Experience with Wiz or comparable cloud security and vulnerability management technologies.
Experience developing detection logic using multiple security data sources.
Experience onboarding, validating, and maintaining SIEM log sources.
Familiarity with Sumo Logic or similar log management platforms.
Experience participating in security incident response investigations and tabletop exercises.
Experience creating security dashboards, metrics, and automated reporting.
Scripting or automation experience using PowerShell, Python, APIs, or similar technologies.
Familiarity with cybersecurity frameworks and practices such as NIST CSF, NIST Incident Response Guidance, MITREATT&CK, CIS Controls, or ISO 27001.
Relevant industry certifications such as CISSP, Security+, CISM, GIAC, GCIH, GCIA, or equivalent certifications are preferred.
What Success Looks Like
A successful Lead Engineer will not simply process alerts. They will continuously improve the effectiveness of security operations by enhancing detection accuracy, identifying monitoring gaps, reducing avoidable false positives, strengthening log coverage, improving vulnerability visibility, and taking ownership of technical security improvements.
They will demonstrate measurable improvements to the security program through stronger detection coverage, more effective correlation rules, improved visibility into security risks, reduced manual effort through automation, enhanced reporting and metrics, and increased incident response readiness.
They are viewed as a trusted technical resource who proactively identifies problems, drives solutions, and helps elevate the overall maturity of Majesco's security operations capabilities.
