Remote Security Engineer

Summary

Join GuidePoint Security as a SOC Engineer to help transform manual processes into automated playbooks, build and augment incident response processes with automation capabilities, and work closely with analysts to understand existing incident response processes.

Requirements

• Minimum 3 years experience in SOC operations supporting incident response and/or detection engineering
• Minimum 1 years experience in building automations in a SOAR platform
• Experience working with structured data (JSON) and REST/SOAP API's
• 1+ years of scripting, Python strongly desired
• DOD 8140.01 – DOD8570.01 M IAT Level II, CSSP Infrastructure
• Ability to demonstrate analytical expertise, close attention to detail, excellent critical thinking, logic, and solution orientation and to learn and adapt quickly
• Knowledge of how common protocols and applications work at the network level, including DNS & HTTPS
• Experience using the Linux command line interface (CLI)

Responsibilities

• Help the SOC transform manual processes into automated playbooks inside a SOAR platform
• Build and/or augment incident response processes with automation capabilities
• Work with analysts to understand existing incident response processes and propose automation use cases to augment those processes
• Use automation to streamline and standardize customer use cases
• Work with management to understand incident response and automation reporting needs, then propose and build relevant reports and dashboards
• Engage with other aspects of the Technical Operations including ticketing, monitoring, and detection tools
• Work closely with the Security Analyst to automate the collection of supporting information for alert analysis and resulting defensive response
• Respond to high-priority requests for information/custom detections from key partners
• Manage and update incident response procedures and workflows/playbooks
• Become a subject matter expert in the customers' high value assets and targets
• Build novel monitoring and alerting playbooks to address potential targeted attacks
• Perform other security operations necessary for continuous monitoring and triaging the platform

Preferred Qualifications

• Experience managing or developing detection logic for enterprise SIEM systems
• Experience with exploitation techniques and use case development
• Experience with IOC datasets (e.g., YARA, OpenIOC, STIX)
• Experience deploying to, and leveraging cloud environments (AWS, Azure, GCP) to extend operational capabilities
• Strong knowledge of network monitoring and network exploitation techniques, including the MITRE ATT&CK technique framework and other common attack vectors

Benefits

• Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions)
• 100% employer-paid medical premiums (employee only $0 deductible and HSA plans) along with 75% employer-paid family contributions
• 100% employer-paid dental premiums (employee only) along with 75% employer-paid family contributions
• 12 corporate holidays and a Flexible Time Off (FTO) program
• Healthy mobile phone and home internet allowance
• Eligibility for retirement plan after 2 months at open enrollment
• Pet Benefit Option