Security Engineer – Detection & Identity
HybridSofia, Sofia-Capital, Bulgaria
Job Summary
Implement and operate the bank's SIEM, configuring correlation rules, detection use cases, and alerting while designing content for threats like account abuse and insider risk. Manage identity and access management controls including access governance and privileged access, and implement user behavior analytics to correlate activity for risk-based detection. Configure anomaly detection monitoring across cloud and hybrid environments, then coordinate and lead technical incident response by investigating security incidents and analyzing large security logs. Develop scripts and automation for detection, enrichment, and response.
Required Qualifications
- Bachelor's or Master's degree in Information Technology, Computer Science, Cybersecurity or a related field
- Proven hands-on experience in security monitoring, detection or incident response, ideally in a financial institution, technology company or another highly regulated environment
- Strong knowledge of SIEM implementation and detection engineering
- Strong knowledge of Identity and access management (IAM) and privileged access
- Strong knowledge of User and entity behaviour analytics (UEBA) concepts
- Strong knowledge of Incident detection, response and investigation
- Strong knowledge of Network communications, enterprise application architecture and cloud technologies
- Strong knowledge of Windows and Linux/UNIX operating systems
- Ability to analyse large datasets and security logs
- Scripting and automation skills
- Strong analytical and problem-solving skills
- Excellent command of English (written and spoken)
Desired Qualifications
- Experience with SIEM, EDR/XDR, UEBA, SOAR or vulnerability-management platforms
- Professional certifications such as CompTIA Security+, CEH, CISSP, GIAC (e.g. GCIA, GCIH), Azure/AWS Security, ISC2 or equivalent
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.