Blue Team Engineer – Defensive Security Specialist

Key responsibilities

• Monitor and analyze security events across SIEM, EDR/XDR, NDR, firewalls, WAF, IDS/IPS, and other controls.
• Investigate and respond to alerts, incidents, and potential threats, performing triage, containment, eradication, and recovery.
• Conduct proactive threat hunting to identify indicators of compromise, suspicious activity, and advanced threats.
• Develop, tune, and maintain detection rules, correlation rules, use cases, dashboards, and alerts.
• Map detected threats to the MITRE ATT&CK framework and perform root‑cause analysis for incidents.
• Analyze logs, network traffic, endpoint telemetry, and malware samples to uncover malicious activity.
• Collaborate with Red Team, vulnerability management, infrastructure and application security teams to improve defensive controls.
• Document incidents, investigations, findings and produce reports and operational metrics for technical and management stakeholders.

Required skills

• 3–5 years of hands‑on experience in Blue Team, SOC, cyber‑defense, threat detection or incident response.
• Strong experience with SIEM platforms such as Microsoft Sentinel, Splunk or QRadar.
• Hands‑on experience with EDR/XDR solutions like Microsoft Defender, CrowdStrike or SentinelOne.
• Deep knowledge of MITRE ATT&CK, Cyber Kill Chain, IOC analysis and detection engineering.
• Proficiency in analyzing Windows Event Logs, Sysmon, firewall, DNS, proxy and authentication logs.
• Network traffic analysis skills using tools such as Wireshark.
• Familiarity with scripting languages – Python, PowerShell or Bash – is an advantage.
• Relevant certifications (e.g., GCIA, GCIH, GCED, Security+, CySA+, SC‑200, BTL, OCEH, CISSP) are preferred.