Cyber Defense Engineer – Security Operations

About the role

BeyondTrust is seeking a Cyber Defense Engineer to protect its enterprise infrastructure and the integrity of its privileged‑access SaaS products. You will work with threat hunters, incident responders and detection engineers, leveraging AI‑driven tools to detect, triage and respond to security events.

Key responsibilities

• Monitor and triage alerts across SIEM, EDR and CSPM platforms, using AI‑assisted enrichment to reduce mean time to detect.
• Lead or participate in incident response engagements, including evidence collection, forensic analysis, root‑cause determination and stakeholder communication.
• Design, implement and tune detection rules on SIEM and EDR, translate threat intelligence into actionable content, and map coverage to MITRE ATT&CK.
• Integrate AI‑driven automation into daily workflows, develop prompts or LLM pipelines, and collaborate with engineering to improve log ingestion.
• Maintain operational documentation, on‑call rotation, and track metrics such as MTTD, MTTR and false‑positive rates.

Required profile

• 2+ years of experience in a SOC, security operations or incident response role.
• Strong understanding of MITRE ATT&CK, network protocols and endpoint behavior.
• Hands‑on experience with at least one SIEM platform and familiarity with writing detection queries.
• Experience with EDR platforms and cloud environments (IaaS preferred).
• Comfort using AI systems (LLM assistants, copilots) as part of security workflows.
• Excellent written communication for both technical and non‑technical audiences.

Required skills

• SIEM platforms (search/detection query creation)
• Endpoint Detection and Response (EDR) tools
• Cloud Security Posture Management (CSPM) solutions
• AI‑driven triage and enrichment tools
• Python or PowerShell scripting for automation
• SOAR or orchestration platforms for automated response
• Identity and Access Management (IAM) platforms