Security Engineer III (EDR) - IN

• Ensure the Customer's operational and production environment remains healthy and secure at all the times.
• Assist with customer onboarding - customer/device onboarding, policy configuration, platform configuration and service transition to security operations team(s).
• Advance platform administration.
• Critical platform incident handling & closure.
• As an SME, act as an L3 escalation and point of contact for SecOps Analysts during an incident response process
• As an SME, act as a champion and centre of enablement by delivering training, coaching and thought leadership across Endpoint Security and Endpoint Detection & Response.
• Develop and document runbooks, playbooks and knowledgebase articles that drive best practice across teams.
• Drive continuous improvement of Rackspace Managed EDR services through custom development, automation and integration; in collaboration with SecOps Engineering and other Security Engineering team(s)
• Maintain close working relationships with relevant teams and individual key stakeholders, such as incident response and disaster recovery teams as well as information security etc.
• Co-ordinate with vendor for issue resolution.
• Required to work flexible timings.

Skills & Experience

• Should have

• Experience of working in two (or more) of the following additional security domains:

o SIEM platforms such as Microsoft Sentinel (preferred), Google Chronicle, Splunk, QRadar, LogRhythm, Securonix etc. o AWS (Amazon Web Services) Security Hub including AWS Guard Duty, AWS Macie, AWS Config and AWS CloudTrail .

• Experience of analysing malware and email headers, and has skills in network security, intrusion detection and prevention systems; operating systems; risk identification and analysis; threat identification and analysis and log analysis.
• Experience of security controls, such as network access controls; identity, authentication, and access management controls (IAAM); and intrusion detection and prevention controls.
• Knowledge of security standards (good practice) such as NIST, ISO27001, CIS (Center for Internet Security), OWASP and Cloud Controls Matrix (CCM) etc.
• Knowledge of scripting and coding with languages such as Terraform, python, javascript, golang, bash and/or powershell.

•

• Computer science, engineering, or information technology related degree (although not a strict requirement)
• Holds one, or more, of the following certificates (or equivalent): -

o Microsoft Certified: Azure Security Engineer Associate (AZ500) o Microsoft Certified: Security Operations Analyst Associate (SC-200) o Systems Security Certified Practitioner (SSCP) o Certified Cloud Security Professional (CCSP) o GIAC Certified Incident Handler (GCIH) o GIAC Security Operations Certified (GSOC) o CrowdStrike admin Certified

• A highly self-motivated and proactive individual who wants to learn and grow and has an attention to detail.
• A great analyser, trouble-shooter and problem solver who understands security operations, programming languages and security architecture.
• Highly organised and detail oriented. Ability to prioritise, multitask and work under pressure.
• An individual who shows a willingness to go above and beyond in delighting the customer.
• A good communicator who can explain security concepts to both technical and non-technical audiences.