Information Security Engineer
TTEC · US-TX-Austin
About this role
Information Security Engineer Be the spark that brightens days and ignite your career with TTEC’s award-winning employment experience. As a Information Security Engineer working remote in US, you’ll be a part of bringing humanity to business. #experienceTTEC Our employees have spoken. Our purpose, team, and company culture are amazing and our Great Place to Work® certification in the United States says it all! What You’ll Do Investigate security alerts and threat hunting leads across a variety of technologies (SIEM, EDR, email security, cloud, etc) as part of the SOC and with the Threat Management team. Maintain situational awareness of changes to threat landscape, industry trends, and internal operating environment. You’ll interact frequently with other members of the Information Security teams, internal IT Operations and Engineering teams, and vendor technical resources. You’ll report to the Information Security Manager. Your role is impactful as it protects TTEC from data loss and security events. During a Typical Day, You’ll Correlate SIEM alerts with endpoint process activity, authentication events, email artifacts, network connections, and cloud audit logs to establish incident timelines, identify affected users and assets, and distinguish benign activity from suspected compromise. Spend time understanding the environment you're responsible for and engage with various teams to gain further knowledge of the environment(s) Recognize potential, successful, and unsuccessful intrusion attempts and compromises through review and analysis of relevant event data Document incident severity, scope, supporting evidence, investigation steps, and recommended actions in case records. Follow approved response playbooks and escalation procedures, coordinate authorized containment and remediation with system owners, and validate recovery before closing incidents. Document incident severity, scope, supporting evidence, investigation steps, and recommended actions in case records. Follow approved response playbooks and escalation procedures, coordinate authorized containment and remediation with system owners, and validate recovery before closing incidents. What You Bring to the Role Hands-on SOC experience investigating and responding to security events across two or more of the following: SIEM, EDR, email security, NGFW, cloud platforms, threat intelligence Partner with the Threat Management team to develop, test, and refine detection queries and investigation playbooks. Validate detections against relevant event data, investigate false positives, and document telemetry gaps and recommended improvements. Ability to investigate cloud security events by reviewing identity and access permissions, administrative activity, audit logs, and network access controls; identify suspicious authentication, privilege changes, and potentially unauthorized access to cloud resources. Working knowledge of TCP/IP, DNS, HTTP/S, common network services, Windows and Linux security logs, and authentication and authorization concepts, with the ability to use this knowledge to interpret suspicious host, user, and network activity. Strong communication and interpersonal skills Preferred: Ability to use a scripting language to parse logs, enrich indicators, and automate repetitive investigation tasks, with appropriate validation, error handling, documentation, and protection of sensitive data. Candidate will possess 2-3 years of experience in Information Systems or IT...
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.