About the Role
We're looking for a Cloud Security Engineer with a strong incident response background to join our security team. You'll be on the front lines detecting, investigating, and remediating security events across our cloud infrastructure and endpoints.
What You'll Do
- Lead end-to-end incident response: triage, containment, investigation, and post-incident review
- Hunt for threats and investigate alerts using CrowdStrike Falcon (EDR, threat intelligence, and OverWatch)
- Build and tune detection logic in Splunk — write SPL queries, create dashboards, and maintain alert fidelity
- Audit and investigate events in AWS CloudTrail, CloudWatch, and native AWS security services (GuardDuty, Security Hub,
Config)
- Correlate signals across endpoint, network, and cloud layers to establish attack timelines
- Document findings and produce clear incident reports for both technical and non-technical audiences
- Contribute to runbooks, playbooks, and continuous improvement of the IR program
What You Bring
- 3+ years in a security engineering, SOC, or incident response role
- Hands-on experience with CrowdStrike (investigation workflows, RTR, detections tuning)
- Proficiency in Splunk — SPL, data onboarding, and building actionable dashboards
- Solid understanding of AWS IAM, CloudTrail log structure, and cloud-native audit trails
- Familiarity with attacker TTPs (MITRE ATT&CK) and how they map to cloud environments
- Ability to communicate technical findings clearly under pressure
Nice to Have
- GCIH, GCFE, AWS Security Specialty, or similar certifications
- Experience with IaC security tooling (Terraform, CloudFormation scanning)
- Scripting ability in Python or Bash for automation and log parsing
Total Experience Expected: 04-06 years