Global Security Operations Engineer

The Global Security Operations Engineer is a senior technical role responsible for strengthening the firm's ability to detect, investigate, respond to, and recover from cybersecurity threats across its global environment. Working as part of the Global Security operations team, the successful candidate will lead complex security investigations, develop and optimize threat detection capabilities, and implement automation to improve the effectiveness and efficiency of security operations. The role combines hands-on incident response with proactive security engineering, helping the firm move from reactive alert management toward an increasingly automated, intelligence-led security operating model. Operating within a geographically distributed organization, the successful candidate will work closely with global and regional technology and security teams, provide technical leadership during significant incidents, and contribute to the continuous improvement of security capabilities. Based in APAC, the role will provide critical regional coverage as part of a coordinated global security operations function.

Responsibilities

Advanced Investigation and Incident Response

Serve as a senior escalation point for security incidents, assuming ownership of complex, ambiguous, and high-severity events that exceed first-line triage capability. Conduct detailed investigations to establish initial access vectors, attacker activities and objectives, scope of compromise, and dwell time, documenting findings to an appropriate evidentiary standard. Perform root cause analysis on confirmed incidents and near misses, identifying underlying security control or process failures rather than simply addressing immediate symptoms. Act as technical lead during significant incidents across containment, eradication, and recovery, coordinating activities across global and regional teams. Conduct host and network forensics and malware triage, engaging specialist forensic providers where investigations exceed internal capabilities. Translate technical findings into clear statements of business risk for leadership and drive post-incident corrective actions through to closure. Investigate identity-based attacks, account compromise, unauthorized access, and suspicious activity across cloud platforms and enterprise applications, including Microsoft 365 and Entra ID. Participate in an on-call rotation and provide out-of-hours escalation support during serious incidents, and undertake additional projects and activities as required.

Security Automation & Detection Engineering

Design, build, tune, and maintain detection content mapped to the MITRE ATT&CK framework, identifying and reporting coverage gaps against threat actor tactics, techniques, and procedures relevant to the firm. Reduce false-positive volume and analyst alert fatigue through systematic tuning, suppression logic, and automated alert enrichment. Operationalize threat intelligence by translating reporting and indicators of compromise into actionable detections, threat-hunting hypotheses, and preventive controls. Design, develop, and maintain automated response playbooks, including Logic Apps, automation rules, and SOAR workflows, to reduce mean time to detect and respond. Write and maintain queries, scripts, and code (KQL, PowerShell, Python, or equivalent) supporting detection, enrichment, automated triage, and reporting. Integrate security tooling and data sources through APIs and connectors, including onboarding new log sources with appropriate parsing, normalization, and validation. Continuously assess and improve security monitoring, detection, and response capabilities, identifying opportunities to strengthen coverage, reduce operational complexity, and improve effectiveness through automation and technology optimization. Identify opportunities to apply AI-assisted investigation, alert triage, and security automation capabilities to improve detection effectiveness, reduce manual effort, and accelerate incident response. Conduct proactive threat hunting to identify suspicious activity, validate detection effectiveness, and uncover threats that may evade existing security controls.

This is a hands-on technical role requiring demonstrated depth in security operations, sound technical judgment, and the ability to work with limited supervision. We value analytical rigor, curiosity, initiative, and a willingness to share knowledge and develop others as highly as any individual technology or certification.

Compulsory Requirements

• 5+ years of experience in security operations, incident response, or detection engineering, including demonstrable experience working in a Security Operations Center (SOC).
• Proven experience leading complex technical investigations end to end, from escalation through root cause analysis to documented remediation.
• Deep, hands-on expertise with modern SIEM and endpoint detection and response (EDR) platforms, including authoring and optimizing detection logic, con

#J-18808-Ljbffr