10 days ago
Responsibilities
- Lead L3 investigations and high-severity incident response through containment, eradication, and recovery.
- Perform host, network, identity, email, and cloud forensics, including log analysis, memory and disk triage, and malware behavior analysis.
- Design, build, test, and tune SIEM and EDR detections and manage the detection lifecycle.
- Engineer normalized, complete, and cost-effective security telemetry pipelines with Cribl.
- Build SOAR playbooks and automations for enrichment, triage, case creation, containment, and closure.
- Develop and operationalize AI-assisted SOC workflows with appropriate security guardrails and human approvals.
- Integrate security tooling through Python, PowerShell, and APIs to reduce repetitive work.
- Conduct threat hunts, assess emerging vulnerabilities, and convert findings into new detections.
- Maintain SOC runbooks, escalation procedures, and tabletop exercises while mentoring L1/L2 analysts.
- Report SOC effectiveness metrics and participate in the senior-tier PagerDuty on-call rotation.
Requirements
- Bachelor’s degree in information security, computer science, or a related field, or equivalent experience.
- At least 6 years of information security experience, including at least 3 years in SOC, incident response, or detection engineering at L2/L3 or equivalent.
- Demonstrated experience leading significant enterprise security investigations and incident response.
- Advanced experience with SIEM and EDR platforms, including Microsoft Sentinel, CrowdStrike NG-SIEM, and KQL or similar query languages.
- Hands-on experience building SOAR playbooks and automations, with Python and/or PowerShell scripting and API integration.
- Practical experience applying AI or LLM tools to security operations and understanding their risks and limitations.
- Working knowledge of Windows, Linux, macOS, Active Directory, Entra ID, email security, network protocols, and Azure/Microsoft 365 attack surfaces.
- Knowledge of MITRE ATT&CK, the NIST incident response lifecycle, and the cyber kill chain.
- Strong technical and executive-level written and verbal communication skills, sound judgment, and ability to prioritize competing work.
- Preferred certifications include GCIH, GCFA, GCIA, GDAT, OSCP, or CrowdStrike/Microsoft security certifications.
- Preferred experience includes OT/ICS security monitoring, Cribl, detection-as-code, Git-based workflows, and working with an MDR provider.
Benefits
- Onsite position in the Charlotte, North Carolina metro area with work from the office five days per week.
- Participation in a PagerDuty on-call rotation.
- CommScope is an Equal Opportunity Employer, including people with disabilities and veterans, and provides an accommodation process for applicants.
About CommScope
CommScope designs and manufactures wired and wireless network infrastructure—fiber and copper cabling, antennas, small cells, broadband access equipment, and enterprise Wi‑Fi (Ruckus Networks)—for service providers, enterprises, and data centers. The company sells hardware, software, and support services globally through direct and channel partners. Founded in 1976 and headquartered in Claremont, North Carolina, CommScope is a public company listed on NASDAQ.