Senior Security Operations Engineer, Zoa

• 5+ years work experience in operational security and hands on experience with the following:
• Basic penetration testing tools like Nessus and Metasploit
• Writing and triaging production security alerts against large data sets, ideally with Splunk or Google Chronical
• Experience in creating security alerts in containerised environments (GCP a plus)
• Security configuration in Docker and Kubernetes
• MISP and other community-centric threat intelligence collections
• Hardening Linux servers and common services
• Hardening and managing MacOs devices
• GCP, AWS, and cloud security and automation tools like Forsetti and Terraform
• Identity and Access Management systems like GSuite, Azure AD, and OneLogin, and authentication integration via OAuth, SAML, and LDAP
• Host policy automation using Jamf for OSX
• Open source security tools such as OpenVas
• Experience mentoring other engineers in security

Desirable

• Working as part of our engineering organisation you will be responsible for designing and building a wide range of new products, services and tools to support the global energy transition
• As a Security Operations engineer you will play a key role in defining and implementing our security controls at Zoa
• You will set-up key technologies, processes and playbooks to keep our customer’s data secure
• Writing, and managing indicators of compromise queries across Zoa’s aggregated logs
• Responding to, triaging, and investigating potential incidents across Zoa’s laptops, servers, network devices, and cloud systems
• Teaching other engineers on Zoa’s infrastructure team how to triage alerts and respond to security incidents
• Performing and automating in-house network and host security testing
• Managing third-party penetration tests
• Acting as incident manager and running interactions with external incident response and forensics teams in the event of a major incident
• Working with infrastructure automation teams to ensure that programmatically-driven security policies are correct
• Implementing security orchestration and automation
• Some on-call will be required