Global Security Operations Engineer

The Global Security Operations Engineer is a senior technical role responsible for strengthening the firm's ability to detect, investigate, respond to, and recover from cybersecurity threats across its global environment.

Working as part of the Global Security operations team, the successful candidate will lead complex security investigations, develop and optimize threat detection capabilities, and implement automation to improve the effectiveness and efficiency of security operations.

The role combines hands-on incident response with proactive security engineering, helping the firm move from reactive alert management toward an increasingly automated, intelligence-led security operating model.

Operating within a geographically distributed organization, the successful candidate will work closely with global and regional technology and security teams, provide technical leadership during significant incidents, and contribute to the continuous improvement of security capabilities. Based in APAC, the role will provide critical regional coverage as part of a coordinated global security operations function.

• →Advanced Investigation and Incident Response
• →Serve as a senior escalation point for security incidents, assuming ownership of complex, ambiguous, and high-severity events that exceed first-line triage capability.
• →Conduct detailed investigations to establish initial access vectors, attacker activities and objectives, scope of compromise, and dwell time, documenting findings to an appropriate evidentiary standard.
• →Perform root cause analysis on confirmed incidents and near misses, identifying underlying security control or process failures rather than simply addressing immediate symptoms.
• →Act as technical lead during significant incidents across containment, eradication, and recovery, coordinating activities across global and regional teams.
• →Conduct host and network forensics and malware triage, engaging specialist forensic providers where investigations exceed internal capabilities.
• →Translate technical findings into clear statements of business risk for leadership and drive post-incident corrective actions through to closure.
• →Investigate identity-based attacks, account compromise, unauthorized access, and suspicious activity across cloud platforms and enterprise applications, including Microsoft 365 and Entra ID.
• →Participate in an on-call rotation and provide out-of-hours escalation support during serious incidents, and undertake additional projects and activities as required.
• →Security Automation & Detection Engineering
• →Design, build, tune, and maintain detection content mapped to the MITRE ATT&CK framework, identifying and reporting coverage gaps against threat actor tactics, techniques, and procedures relevant to the firm.
• →Reduce false-positive volume and analyst alert fatigue through systematic tuning, suppression logic, and automated alert enrichment.
• →Operationalize threat intelligence by translating reporting and indicators of compromise into actionable detections, threat-hunting hypotheses, and preventive controls.
• →Design, develop, and maintain automated response playbooks, including Logic Apps, automation rules, and SOAR workflows, to reduce mean time to detect and respond.
• →Write and maintain queries, scripts, and code (KQL, PowerShell, Python, or equivalent) supporting detection, enrichment, automated triage, and reporting.
• →Integrate security tooling and data sources through APIs and connectors, including onboarding new log sources with appropriate parsing, normalization, and validation.
• →Continuously assess and improve security monitoring, detection, and response capabilities, identifying opportunities to strengthen coverage, reduce operational complexity, and improve effectiveness through automation and technology optimization.
• →Identify opportunities to apply AI-assisted investigation, alert triage, and security automation capabilities to improve detection effectiveness, reduce manual effort, and accelerate incident response.
• →Conduct proactive threat hunting to identify suspicious activity, validate detection effectiveness, and uncover threats that may evade existing security controls.

This is a hands-on technical role requiring demonstrated depth in security operations, sound technical judgment, and the ability to work with limited supervision. We value analytical rigor, curiosity, initiative, and a willingness to share knowledge and develop others as highly as any individual technology or certification.

• 5+ years of experience in security operations, incident response, or detection engineering, including demonstrable experience working in a Security Operations Center (SOC).

• Proven experience leading complex technical investigations end to end, from escalation through root cause analysis to documented remediation.

• Deep, hands-on expertise with modern SIEM and endpoint detection and response (EDR) platforms, including authoring and optimizing detection logic, conducting investigations, and managing data onboarding.

• Strong practical automation and scripting abilities, including KQL and at least one of PowerShell or Python, with demonstrated experience developing and operating automation in production.

• Experience designing and maintaining automated response playbooks using Logic Apps, automation rules, or comparable SOAR capabilities.

• Advanced knowledge of the MITRE ATT&CK framework, Cyber Kill Chain analysis, and established incident response methodologies, such as PICERL.

• Strong working knowledge of TCP/IP and networking, Windows and Linux operating systems, Active Directory, Entra cloud identity and authentication, and security operations across cloud and hybrid environments.

• Experience with host and network forensics, malware triage, and the analysis of malicious email headers, links, and attachments.
• Strong written and verbal communication skills, including the ability to communicate technical findings and security risks to both technical and nontechnical audiences.

• Ability to work independently and collaborate effectively with geographically dispersed teams, with flexibility to provide out-of-hours support during significant security incidents.

• Occasional travel to support global cybersecurity operations and incident response may be required

• Bachelor's degree in Information Security, Information Technology, Computer Science, or a related discipline, or equivalent professional experience.
• Industry certifications such as GCIH, GCIA, GCFA, GREM, OSCP, CySA+, SC-200, AZ-500, or CISSP.
• Hands-on experience with Microsoft security technologies, including Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID, and Microsoft Azure.
• Experience operating within a global, federated, or shared-services model, ideally in professional services or another highly regulated sector.
• Familiarity with ISO 27001, the NIST Cybersecurity Framework, or comparable control frameworks