Note: The job is a remote job and is open to candidates in USA. Careful Security is a boutique cybersecurity and compliance firm that provides security operations and virtual CISO services for a portfolio of clients. The Security Operations Engineer will build and operate multi-tenant security stacks, including SIEM, EDR, RMM, identity, Azure, and network security environments, while handling detection tuning, incident response, and client communication.
Responsibilities
- Build SIEM deployments from scratch in client clouds (Wazuh): installation, log-source onboarding, rules, alert tuning, dashboards
- Administer and migrate EDR across client tenants (SentinelOne): deployment, policy, exclusion discipline on shared consoles
- Run RMM onboarding, patching, scripting, SSO and roles (NinjaOne)
- Manage user lifecycles across M365, Entra ID and Google Workspace: provisioning, offboarding, access revocation, credential rotation
- Write and maintain the queries, scripts and API pulls behind client security KPIs and alerting
- Stand up and harden Azure environments: VMs, networking, Entra ID, RBAC
- Triage and tune detections; run incident response for phishing, BEC and endpoint compromise
- Design network and SASE segmentation; verify backup and recovery actually restores
- Brief client leadership in plain language
Skills
- - 3+ years in an MSP or MSSP administering security and IT tooling across multiple client tenants
- - Hands-on EDR administration (SentinelOne or equivalent: CrowdStrike, Defender for Endpoint): deployment, policy, exclusions, tenant migration
- - RMM administration (NinjaOne or equivalent: Datto, ConnectWise, Kaseya): onboarding, patching, scripting, SSO and role configuration
- - Built or substantially rebuilt a SIEM deployment (Wazuh, Security Onion, Elastic, or Splunk): installation, log-source onboarding, rule and alert tuning, not just console use
- - Azure administration: VMs, networking, Entra ID, RBAC, and standing up new environments from scratch
- - User lifecycle management across M365 / Entra / Google Workspace: provisioning, offboarding, access revocation, credential rotation
- - Alert triage and management: tuning noise down without suppressing true positives
- - Comfortable writing queries and scripts for security KPIs and reporting (KQL, SQL, PowerShell, Python, or API-based)
- - SentinelOne, NinjaOne, or Wazuh specifically (we run all three)
- - Cato SASE, Cisco Umbrella, KeepAware, or Microsoft Purview exposure
- - SOC analyst experience: incident response, phishing and BEC investigation, endpoint isolation
- - Experience building client environments or security stacks from zero at an MSP
- - Certifications (AZ-500, SC-200, Security+, GCIH, OSCP) welcome; judgment matters more than letters
Company Overview