Security Platform Engineer

About the Role

The Security Platform Engineer is a seasoned subject matter expert responsible for facilitating problem resolution and mentoring for the overall team. This role performs operational security tasks such as performance and availability monitoring, log monitoring, security incident detection and response, security event reporting, and content maintenance (tuning). The Security Platform Engineer is responsible for detecting and monitoring escalated threats and suspicious activity affecting the organization's technology domain (servers, networks, appliances and all infrastructure supporting production applications for the enterprise, as well as development environments).

Key Responsibilities

• Works as part of a 24/7 team working on rotational shifts.
• Works as part of Platform and Content Engineering handling tunings, stakeholder requests, escalations, reporting, and trainings.
• Administers the organization's security tools to gather security logs from the environment.
• Performs lifecycle management of supported security tools/technologies, break-fix, patching, and live updates.
• Adheres to SOPs and notifies stakeholders on log flow/log format issues.
• Documents best practices.
• Identifies opportunities to create automations that will assist the incident response team.
• Performs security incident handling and response from several vectors including End Point Protection and Enterprise Detection and Response tools, attack analysis, malware analysis, network forensics, computer forensics, and a broad range of skills in LAN technologies, Windows and Linux O/S’s, and general security infrastructure.
• Carries out agreed maintenance tasks.
• Ensures usage of knowledge articles in incident diagnosis and resolution and assists with updating them as and when required.
• Performs defined tasks to monitor service delivery against service level agreements and maintains records of relevant information.
• Investigates causes of incidents and seeks resolution.
• Escalates unresolved incidents and follows up until resolution.
• Provides service recovery following incident resolution.
• Documents and closes resolved incidents according to agreed procedures.
• Investigates and identifies root causes of incidents and assists with the implementation of agreed remedies and preventative measures.
• Maintains knowledge of specific specialisms, provides detailed advice regarding their application.
• Ensures efficient and comprehensive resolution of incidents, including ensuring that repairs are carried out by coordinating product requests and working with other team members.
• Logs all incidents in a timely manner with the required level of detail.
• Cooperates with all stakeholders, including client IT environments, vendors, and carriers, to expedite diagnosis of errors and problems and to identify a resolution.

Requirements & Tech Stack

• Seasoned working knowledge on implementation and monitoring of any SIEM or security tools/technologies.
• Seasoned knowledge on security architecture, worked across different security technologies.
• Customer service oriented and pro-active thinking.
• Problem solver who is highly driven and self-organized.
• Great attention to detail.
• Good analytical and logical thinking.
• Excellent spoken and written communication skills.
• Team player with the ability to work well with others and in groups with colleagues and stakeholders.
• Seasoned experience in Security technologies like (Firewall, IPS, IDS, Proxy, etc.).
• Seasoned experience in technical support to clients.
• Seasoned experience in diagnosis and troubleshooting.
• Seasoned experience providing remote support in Security Technologies.
• Seasoned experience in SOC/CSIRT Operations.
• Seasoned experience in handling security incidents end to end.
• Knowledge on networking, Linux, and security concepts.
• Seasoned experience in configuring/managing security controls such as Firewall, IDS/IPS, EDR, NDR, UTM, Proxy, SOAR, HoneyPots, and other security tools.
• Knowledge on log collection mechanisms such as Syslog, Log file, DB API.
• Knowledge in security architecture.
• Seasoned experience in Security engineering.

Qualifications

• Bachelor's degree or equivalent in Information Technology or related field.
• Relevant level of Networking certifications such as CCNA, JNCIA, ACCA, PCNSA, CCSA etc. preferred.
• Relevant level of Security certifications such as AZ-500, SC-200, Security+, CEH, CISSP, CISM etc. will be an added advantage.

Workplace Type

• On-site Working