Key Responsibilities 

As a core member of the BSS-CERT, you will shape our technical capabilities and directly contribute to our clients’ security posture.

• Lead Advanced Threat Response: Own security incidents from detection to closure. You will be technical authority for complex investigations escalated from L1/L2, performing deep-dive analysis to understand the threat, its impact, and orchestrating the response.
• Engineer & Automate: Be our automation champion. Identify inefficiencies and build robust solutions using Python, PowerShell, and other tools. You will design, develop, and deploy new playbooks, runbooks, and integrations for our SOAR and SIEM platforms.
• Enhance Detection Capabilities: Constantly refine our security posture. You will proactively hunt for threats, perform threat modeling, and leverage your knowledge of attacker TTPs to write more intelligent detection rules and improve our monitoring strategy across SIEM, EDR, and IDS systems.
• Innovate & Research: Drive our R&D efforts. You’ll investigate emerging threats, test new security tools, and develop novel defense techniques. You’ll have the opportunity to create realistic attack/defense scenarios for our cyber range.
• Mentor & Collaborate: Act as a technical guide for your colleagues. You’ll share your expertise, improve documentation, and work closely with our Red Team and Vulnerability Management teams to create a powerful, unified security function.

Requirements:

• Experience: 2-5 years in a hands-on cybersecurity role (e.g., SOC Analyst, Security Engineer, Incident Responder).
• Technical Foundations: A solid grasp of network protocols, services, vulnerabilities, and common attack vectors.
• Automation Mindset: Proven scripting skills (Python, Bash, or PowerShell) and a genuine passion for automating manual tasks. You see a repetitive process and immediately think, “I can build a script for that.”
• Key Skills: Familiarity with modern security concepts, including application, network, and cloud security. You are detail-oriented, highly organized, and an excellent communicator.
• Attitude: You are a self-starter who thrives on autonomy and doesn’t want to be micromanaged. You are a natural collaborator who elevates the team around you.
• Excellent analytical, critical thinking, and problem-solving skills, with the ability to perform calmly under pressure.

Competitive advantage

• SOC Tooling: Hands-on experience with SIEM (Elastic, Splunk), SOAR (Phantom, Demisto), and EDR platforms.
• Infrastructure as Code: Familiarity with tools like Ansible, Terraform, or Docker/Kubernetes.
• Offensive Security: A background in penetration testing, malware analysis, or bug bounties.
• Frameworks & Standards: Knowledge of MITRE ATT&CK®, ISO 27001, PCI DSS, GDPR, or NIS, NIST SP800-61r1, SP800-61r2, SANS PICERL.
• Previous experience with raw log file review, data correlation, and analysis, as well as with network security tools, network traffic analyzers, firewall logs, network flows, intrusion detection systems, system logs, memory dumps, vulnerability management, SOAR platforms, SIEM, especially Elastic SIEM, and other Enterprise / Open Source equivalents.
• Certifications: Professional certifications are valued (GIAC, OSCP, CompTIA, etc.).
• Experience working in a Managed Security Service Provider (MSSP) environment.