Expert Engineer – Security Operations Centre

About the role

The Expert Engineer will lead incident response, conduct host‑level and network forensics, and proactively hunt for threats across the organisation's environment. This role requires deep technical expertise in digital forensics, threat intelligence, and cloud incident response.

Key responsibilities

• Lead incident response and host‑level investigations, including forensic analysis of Windows, Linux, macOS and mobile devices.
• Perform network forensics using NDR platforms and Security Onion, and conduct initial malware analysis.
• Develop and execute advanced threat‑hunting queries, custom searches and playbooks using MITRE ATT&CK framework.
• Monitor threat intelligence feeds, security blogs and industry news to stay current on emerging threats.
• Automate security log analysis with custom scripts (Python, PowerShell) and integrate findings into SIEM platforms such as Microsoft Sentinel and Splunk.
• Provide cloud incident response for Azure and AWS environments and ensure timely closure of incidents per SLA.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science or related field, or equivalent experience.
• Minimum 6 years of hands‑on experience in digital forensics, incident response or threat hunting.
• Strong background in Windows and Linux environments, with ability to read and interpret logs.
• Experience with Docker or Kubernetes and DFIR‑related certifications (SANS GCFA, GCFE, GCIH, etc.).
• Proven ability to handle end‑to‑end investigations, evidence processing and chain‑of‑custody compliance.

Required skills

• Forensic tools: FTK, EnCase, Oxygen, Cellebrite, Volatility.
• SIEM platforms: Microsoft Sentinel, Splunk; query language KQL.
• Cloud platforms: AWS, Microsoft Azure.
• Scripting: Python, PowerShell.
• Container technologies: Docker, Kubernetes.
• Threat‑hunting frameworks: MITRE ATT&CK.
• Network detection: NDR, Security Onion.