1 day ago
London, United KingdomSenior
Responsibilities
- Investigate and triage security alerts using endpoint, identity, cloud, network, and other telemetry.
- Support incident response and digital forensics, including evidence preservation, timeline reconstruction, containment, root cause analysis, and post-incident reviews.
- Engineer and improve SIEM capabilities by onboarding and normalizing log sources, maintaining parsers, and improving data pipelines, coverage, quality, and performance.
- Develop and maintain detections using detection-as-code practices, version control, peer review, automated testing, and MITRE ATT&CK mapping.
- Apply AI and machine learning to alert triage, incident response, threat intelligence analysis, threat hunting, and detection-content prioritization.
- Integrate threat intelligence into detection logic, response playbooks, hunting activities, and security tooling.
- Conduct proactive threat hunts and use findings to improve detection engineering and security tooling.
Requirements
- Commercial experience in a security operations role, including securing cloud-native environments and modern application stacks.
- Hands-on experience with security incident investigations, evidence preservation, log and artifact analysis, timeline reconstruction, and root cause identification.
- Practical experience developing and tuning SIEM detections, writing threat-hunting queries, and participating in incident response.
- Hands-on knowledge of SIEM platforms, EDR/XDR solutions, vulnerability scanners, and ticketing or case-management systems.
- Experience using threat intelligence platforms and feeds and integrating intelligence into security operations.
- Proficiency in one or more scripting or programming languages such as Python, Go, or Bash.
- Familiarity with secure development practices, OWASP risks, code reviews, and remediation of security findings.
- Working knowledge of NIST CSF, CIS Benchmarks, MITRE ATT&CK, SOC 2, or ISO 27001.
- Strong communication and cross-functional collaboration skills with technical and non-technical stakeholders.
About Anaplan
Anaplan builds a cloud platform for enterprise planning, forecasting, and scenario modeling used by finance, supply chain, sales, and workforce teams. It sells subscription software and related services to large organizations that need connected, cross-functional planning. Founded in 2006 and headquartered in Miami, Florida, Anaplan was acquired by Thoma Bravo in 2022 after previously trading on the NYSE.