Essential Functions:

Platform Engineering & Optimization

Configure, maintain, and optimize assigned security platforms across endpoint, network, web, and identity domains Continuously refine policies, detection logic, and configurations to improve signal quality, reduce false positives, and enhance visibility Apply platform capabilities to develop and improve detection coverage (e.g., IOA, behavioral detection) Ensure platform health, telemetry integrity, and effective coverage across environments Evaluate and implement enhancements that improve effectiveness of existing tools before recommending new solutions

Alert Analysis & Investigation

Analyze alerts and raw telemetry generated by security platforms and determine appropriate action based on context and risk Investigate suspicious activity using available data sources, including logs, network traffic, and endpoint behavior Apply independent judgment to distinguish between benign, anomalous, and malicious ...