Senior Cybersecurity Specialist

Creating complex SPL queries for threat hunting, developing custom detection rules and alerts, optimising data models, and onboarding new log sources. You'll be tuning it to reduce false positives and maximise real threat detection.

Conducting advanced threat hunting via Falcon Query Language (FQL), creating custom Indicators of Compromise (IOCs), tuning prevention policies, and performing host containment and forensic data collection during incidents.

Configuring detailed scan policies, managing asset groups, validating scan findings, and prioritising remediation efforts by adding business context to the raw vulnerability data. You'll be the one making sense of the noise.

Writing and troubleshooting security policies on firewalls, configuring App-ID and User-ID for granular control, and analysing packet captures to understand network traffic and identify malicious behaviour.

Creating custom security checks for cloud environments, automating remediation of misconfigurations using serverless functions (e.g., AWS Lambda, Azure Functions), and integrating cloud security into CI/CD pipelines.

Using these tools to validate identified vulnerabilities, develop custom payloads for testing, and perform advanced manual penetration testing techniques to understand attack paths. This is about thinking like the adversary.

Mapping security controls to compliance evidence, responding to audit requests by pulling relevant data, and tracking policy exceptions. You'll help ensure we're not just secure, but also compliant.

• IT Operations Team
• Software Engineering Leads
• Product Management
• Legal & Compliance
• Senior Leadership (during incidents)

• External Security Auditors
• Security Tool Vendors
• Incident Response Consultants (if engaged)

Attackers are getting stealthier, 'living off the land' and using legitimate tools. Signature-based detections aren't enough. We need to find the subtle behavioural anomalies that indicate a breach.

Hypothesis-driven threat hunting · Statistical anomaly detection · Graph analysis for attacker movement · Memory forensics for advanced malware

• This week: Read up on advanced threat hunting methodologies from industry leaders (e.g., SANS, Mandiant).
• This month: Pick a specific MITRE ATT&CK technique and develop a threat hunt plan for it within our environment.
• Month 2: Experiment with forensic tools like Volatility Framework for memory analysis in a lab environment.
• Month 3: Lead a 'purple team' exercise where you simulate an attack and then hunt for it in real-time with the blue team.

Quick win: Start subscribing to advanced threat intelligence feeds and blogs that focus on behavioural analysis rather than just IOCs.

The volume of alerts and manual tasks is unsustainable. We need to automate repetitive incident response steps, enrich data, and orchestrate complex workflows to scale our security operations.

Playbook development and automation · API integration for security tools · Low-code/no-code SOAR platforms · Automated threat intelligence enrichment

• This week: Research common SOAR platforms (e.g., Splunk SOAR, Palo Alto Cortex XSOAR) and their capabilities.
• This month: Identify one repetitive manual task in our incident response process and design a simple automation playbook for it.
• Month 2: Experiment with a SOAR platform in a lab environment, building a basic automated workflow.
• Month 3: Propose a pilot project for SOAR implementation for a specific incident type, demonstrating potential time savings.

Quick win: Start using simple Python scripts to automate data collection from common security APIs (e.g., VirusTotal, Shodan).