Cyber Defense Engineer, Kraken.tech

• A strong Security Operations and technology background
• Experience in using SIEM platforms to analyse and respond to security alerts
• Familiarity with EDR (Endpoint Detection and Response) tools and their capabilities, including host containment and evidence preservation
• Knowledge of best practices for analysing incidents and logs in a cloud environment
• An understanding of how different mitigation strategies can contain and respond to security events
• An understanding of Cloud and software architectures
• Strong analytical and problem-solving skills, with the ability to identify, triage and mitigate incidents
• Ability to collaborate effectively across Cyber Defense functions and with internal stakeholders, communicate clearly during potentially high-pressure incidents, and support colleagues to deliver a coordinated, timely, and effective incident response
• A passion for security, a drive to improve security alerting and response processes by harnessing technology and automation
• Good experience in at least some of the areas mentioned above (we’re not expecting any candidate to be an expert in all areas)

Desirable

• We are seeking a Security Operations Analyst that will become a member of a growing global Security Team in Kraken Technologies. You’ll play a crucial role in helping to ensure that we continue to protect Kraken and our Clients by analysing and responding to security incidents
• This is a critical position that is a full-time member of a team approaching security in a way which is able to move at the pace of Kraken
• Working as part of the Global Cyber Defense Center (CDC), you will contribute to a broad range of cyber defense functions, including Kraken’s Security Operations Center (SOC), threat intelligence, detection engineering, incident response, and continuous improvement of our detection and response capabilities
• Monitoring, triaging, and investigation of security incidents on Kraken’s infrastructure and Client instances
• Responding to alerts generated by our Security Information and Event Management (SIEM) system
• Automating and continuously expanding the detection capabilities
• Analysing application, Cloud and access logs and events to identify potential security threats and vulnerabilities and coding this analysis for future playbooks
• Identifying where escalation of incidents, or notification to third parties may be required
• Providing incident response support working with our engineering and product teams where necessary
• Maintaining, improving and automating incident response processes and playbooks, to continually improve the team's capabilities
• Preparing reports and incident summaries, as well as reviewing and improving the content and presentation of reports produced by the team
• Maintaining and updating security incident documentation including analysis findings and recommended mitigation strategies, automating wherever possible
• Liaising with stakeholders in relation to incident root cause and providing remediation/improvement recommendations