Responsibilities
- Direct the development and execution of security operations strategy, serving as the main internal contact for the managed SOC provider for escalations, tuning requests, and SLA oversight.
- Manage the full incident response lifecycle, including detection, triage, containment, and post-incident analysis, whether incidents originate internally or are escalated by the SOC provider.
- Lead efforts in identifying and responding to phishing threats, including evaluating reported emails, coordinating takedown actions, running employee awareness campaigns, and improving email security configurations.
- Develop, implement, and refine detection rules and threat-hunting queries in Microsoft Sentinel and Defender XDR using KQL for improved threat visibility.
- Administer and enhance the Microsoft Defender suite across endpoints, cloud environments, identity systems, and Office 365 to ensure optimal protection and configuration.
- Oversee the end-to-end vulnerability management process using Tenable for vulnerability scanning and ServiceNow Vulnerability Response for tracking remediation progress and enforcing SLAs.
- Maintain and optimize Palo Alto firewall policies, ensure rule consistency, and integrate firewall logs into monitoring systems.
- Ensure comprehensive EDR and NDR coverage, and analyze correlated alerts from endpoint and network data sources to improve detection accuracy.
- Develop and maintain PowerShell scripts to automate incident response actions and streamline operational workflows.
- Collaborate with IT, engineering, and compliance teams during audits, control assessments, and architectural reviews to align security practices with business needs.
- Produce and deliver regular reports on security metrics, incident summaries, and overall risk status to executive leadership.
