Expert Engineer – Security Operations Centre

About the role

The Expert Engineer will lead incident response, host‑level investigations and forensic analysis for the Security Operations Centre. You will proactively hunt for threats, develop remediation strategies and ensure timely closure of incidents in a high‑stress environment.

Key responsibilities

• Monitor threat intelligence feeds, security blogs and industry news to stay ahead of emerging threats.
• Conduct forensic investigations of data breaches, APTs, ransomware and insider threats using tools such as FTK, EnCase and Cellebrite.
• Analyze security events from SIEM, IDS/IPS, firewalls, endpoint detection tools and network traffic.
• Develop and execute advanced threat‑hunting queries, custom searches and playbooks using MITRE ATT&CK and KQL.
• Perform host‑based forensics on Windows, Linux, macOS and mobile devices, and network forensics with NDR and Security Onion.
• Automate log analysis and incident‑response tasks with Python or PowerShell scripts.
• Lead cloud incident response for Azure and AWS environments.

Required profile

• Minimum 6 years of experience in digital forensics, incident response or threat hunting.
• Bachelor’s degree in Cybersecurity, Computer Science or equivalent work experience.
• Hands‑on experience with Windows and Linux environments and ability to interpret system logs.
• Strong investigative skills covering end‑to‑end case handling and evidence processing.
• Relevant DFIR certifications (e.g., SANS GCFA, GCFE, GCIH) preferred.

Required skills

• Threat Hunting, Incident Response, Digital Forensics
• Docker or Kubernetes
• Windows, Linux, macOS, mobile forensics
• FTK, EnCase, Oxygen, Cellebrite, Volatility
• Azure, AWS cloud forensics
• Python, PowerShell scripting
• KQL (Kusto Query Language) for Microsoft Sentinel and Splunk SIEM platforms
• MITRE ATT&CK framework