Security Engineer
First Advantage1 day ago
Remote, IndiaMid Level
Responsibilities
- Investigate and resolve Level 2 and Level 3 alerts, cases, and incidents using established procedures, playbooks, and escalation paths.
- Analyze endpoint, identity, email, cloud, network, SaaS, PaaS, API, web application, and database telemetry to validate activity and determine scope.
- Develop, test, peer review, deploy, tune, regression-test, and document detections, queries, correlations, analytics rules, and incident logic.
- Create approved enrichment, triage, notification, containment, and remediation workflows for repeatable Tier 1 scenarios.
- Support Sentinel, Defender XDR, SOAR, telemetry connectors, case management, platform configuration, integrations, and troubleshooting.
- Develop and maintain detections for suspicious application activity, privilege changes, API abuse, authentication anomalies, database access, and data-exfiltration indicators.
- Execute scoped threat hunts and retrospective searches using established hypotheses and analysis methods.
- Maintain accurate case records, detection documentation, runbooks, automation procedures, technical procedures, and MITRE ATT&CK mappings.
- Contribute to SOC engineering project milestones and escalate work beyond established authority, procedures, or technical scope.
Requirements
- General knowledge of security operations, incident response, detection engineering, and common attacker techniques.
- Hands-on experience with SIEM, EDR/XDR, SOAR, or comparable security technologies.
- Experience using KQL, SPL, SQL, or a comparable query language.
- Foundational experience with PowerShell, Python, APIs, or comparable automation technologies.
- Experience investigating endpoint, identity, email, cloud, network, or application security activity and preserving clear evidence of analysis.
- Working understanding of incident classification, escalation, containment, remediation, and recovery practices.
- Ability to use engineering standards, peer review, source control, testing, and controlled deployment processes.
- Ability to document technical findings clearly, balance concurrent incidents and engineering work, communicate status, and exercise sound escalation judgment.
- Bachelor's degree plus 2 years of experience, Master's degree plus 0 years, PhD plus 0 years, or equivalent knowledge or work experience.
- Preferred experience with Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, Azure, AWS, or Microsoft 365.
- Preferred experience working with an outsourced SOC, MDR, MSSP, or managed threat hunting provider.
- Preferred experience creating security rules, playbooks, automation workflows, response actions, dashboards, or operational metrics.
- Relevant certifications such as SC-200, Security+, CySA+, or AZ-500 are preferred.
About First Advantage
First Advantage builds software and data services for employment background screening, identity verification, and compliance used by employers and housing providers. Its products span criminal checks, Form I-9 and E-Verify workflows, fingerprinting, social media checks, and post-hire monitoring, exposed via web platforms and APIs. Headquartered in Atlanta, Georgia, it is a public company listed on Nasdaq (FA) with global operations across more than 200 countries and territories.