Note: The job is a remote job and is open to candidates in USA. Pearl Consulting Group is seeking an experienced engineer to support the transformation and operational excellence of its Security Operations and Incident Response program. The role focuses on investigating and eradicating cybersecurity threats, developing detection and response capabilities, refining security processes and technologies, and supporting incident response leadership across a global enterprise.
Responsibilities
- Expert-level support for deep dive investigations, including digital forensics (memory, network, and malware analysis)
- Author and refine IR playbooks and operational guidelines to ensure the team remains agile in an evolving threat landscape
- Develop and maintain threat models, incorporating findings from penetration tests into detection strategies
- Design, implement, and refine complex detection rules and automated remediation workflows to identify adversarial behavior
- Utilize threat intelligence and the MITRE ATT&CK framework to identify gaps in visibility and proactively mitigate emerging risks
- Maintain comprehensive documentation of detection strategies, active investigations, and incident timelines
- Work with the SIEM team to continuously tune SIEM rules to maximize detection fidelity while minimizing alert fatigue
- Review and tune threat intelligence systems, including brand protection and dark web monitoring
- Proficiency in scripting and query building using Python, XQL, PowerShell, or Bash, and experience with automation and/or orchestration (SOAR) tools
- Support IR leadership as backup on IR-related activities
Skills
- Bachelor's degree and 5+ years of relevant experience in incident response and SOC tooling
- In-depth knowledge of SIEM/SOAR platforms (e.g., Microsoft Sentinel, Palo Alto Cortex XSIAM/XSOAR) and incident response processes in hybrid cloud environments (GCP, Azure)
- Experience leading incident response as incident commander, performing root cause analysis and continuous optimization for SOC tools and processes
- Understanding of regulatory compliance and frameworks such as MITRE ATT&CK, NIST, or ISO
- Ability to prioritize tasks effectively, manage multiple priorities, and work both independently and as part of a team
- Strong communication skills, with the ability to translate sophisticated technical issues or concepts to non-technical audiences in a clear and concise manner that focuses on business value
- Familiarity with scripting languages (Python, PowerShell, Bash, XQL) is highly preferred
Benefits
- Remote or Hybrid
Company Overview