Responsibilities
- Operate and improve SIEM, EDR, cloud, identity, email, and security monitoring capabilities.
- Develop and tune detection rules, analytics, dashboards, alert routing, and investigation playbooks.
- Investigate security alerts and incidents, including scoping, evidence collection, containment, remediation coordination, and recovery tracking.
- Lead triage and risk-based remediation of vulnerability, exposure, endpoint patching, CSPM, and CWP findings.
- Partner with Cloud Security on posture-management rules, alert tuning, cloud logging, and recurring misconfiguration analysis.
- Define monitoring and detection requirements for new cloud services, SaaS capabilities, and major architecture changes.
- Develop detections for risky identity, endpoint, and cloud administration activity and support endpoint-hardening efforts.
- Build scripts, integrations, workflows, and playbooks for triage, enrichment, notification, containment, remediation tracking, and reporting.
- Improve telemetry coverage and monitor log-source and connector health across cloud, identity, endpoint, SaaS, and network sources.
- Maintain metrics for detection, response, alert quality, vulnerability risk, cloud exposure, and remediation performance.
- Assess AI tools, agents, plugins, and MCP integrations for data access, identity, execution, retention, and supply-chain risks.
- Design and operate AI security guardrails, onboard AI telemetry into the SIEM, and build detections and response playbooks for AI-related threats.
- Run controlled AI pilots and adversarial tests, measure false positives and user impact, and promote controls based on evidence.
- Provide security guidance to engineering and IT teams, mentor analysts and engineers, and coordinate cross-functional remediation.
Requirements
- At least 5 years of hands-on experience in Security Operations, Security Engineering, Detection Engineering, Incident Response, or a related field.
- Strong experience with SIEM operations, detection engineering, alert triage, investigation, and incident response.
- Practical experience with vulnerability management, endpoint patching and hardening, CSPM/CWP, cloud security posture, or attack-surface analysis.
- Experience with Azure, AWS, or comparable cloud environments; multi-cloud experience is preferred.
- Strong understanding of identity and access risks, privileged activity, risky sign-ins, and cloud administration.
- Understanding of AI security risks including prompt injection, excessive agency, data leakage, tool misuse, and AI supply-chain risk.
- Ability to query and analyze security data using KQL, SQL, or an equivalent language.
- Ability to automate with Python, PowerShell, JavaScript, or a comparable language, including API integration.
- Experience with endpoint, email, SaaS, cloud, and identity security telemetry.
- Strong technical writing and communication skills and the ability to work with distributed, cross-functional teams.
- Ability to work independently, make sound decisions under pressure, and manage competing priorities.
- Preferred experience with Microsoft Sentinel, Microsoft Defender, Log Analytics, SOAR, or comparable platforms.
- Preferred familiarity with MITRE ATT&CK, Sigma, YARA, threat hunting, or detection testing.
- Preferred experience with infrastructure-as-code, CI/CD, containers, or Kubernetes security.
- Experience securing LLMs, AI agents, MCP or plugin ecosystems, AI-enabled SaaS tools, or AI runtime environments is preferred.
- Preferred experience with endpoint privilege management, privileged access workstations, application control, least-privilege, or attack-surface-reduction measures.
- Preferred experience supporting SOC 2, ISO 27001, NIST, FedRAMP, or similar assurance requirements.
- Relevant security certifications or equivalent practical experience are preferred.
Benefits
- Hybrid work model where a required location is specified, with up to three days per week in the office and the remaining days remote.
- Global cybersecurity team focused on innovation, curiosity, integrity, initiative, and work-life balance.
Tech Stack
Categories
About Semperis
For security teams charged with defending hybrid and multi-cloud environments, Semperis ensures the integrity and availability of critical enterprise directory services at every step in the cyber kill chain and cuts recovery time by 90%. Purpose-built for securing hybrid identity environments—including Active Directory, Entra ID, and Okta—Semperis’ AI-powered technology protects over 100 million identities from cyberattacks, data breaches and operational errors. The world’s leading organizations trust Semperis to spot directory vulnerabilities, intercept cyberattacks in progress and quickly recover from ransomware and other data integrity emergencies. Semperis is headquartered in Hoboken, New Jersey, and operates internationally, with its research and development team distributed throughout the United States, Canada and Israel. Semperis hosts the award-winning Hybrid Identity Protection conference and podcast series (www.hipconf.com) and built the community hybrid Active Directory cyber defender tools, Purple Knight (www.semperis.com/purple-knight/) and Forest Druid. The company has received the highest level of industry accolades, recently named to Inc. Magazine’s list of best workplaces for 2024 and ranked the fastest-growing cybersecurity company in America by the Financial Times. Semperis is a Microsoft Enterprise Cloud Alliance and Co-Sell partner and is a member of the Microsoft Intelligent Security Association (MISA).