Описание
EPAM helps enterprises through software products, open-source solutions, and accelerators.
Задачи
•Monitor security alerts and logs across endpoints, networks, cloud environments, and applications using SIEM/SOAR platforms
•Investigate and respond to security incidents through triage, containment, and root-cause analysis
•Develop and tune detection rules, correlation logic, and alerting to reduce false positives and close coverage gaps
•Build and maintain incident-response automation and SOAR playbooks
•Conduct vulnerability management, including scanning, prioritization, and remediation coordination with engineering teams
•Perform threat hunting to proactively identify malicious activity
•Support the deployment and integration of security tooling, including EDR, SIEM, cloud security posture tools, and IAM
•Participate in the on-call rotation for security incidents
•Contribute to post-incident reviews and documentation, including runbooks and RCAs
•Collaborate with IT, DevOps, and engineering teams to harden infrastructure and enforce security best practices
•Assist with compliance and audit activities, including SOC 2 and ISO 27001
Требования
•5+ Years of experience in security operations, incident response, or a related field
•At least 1 year of relevant leadership experience
•Hands-on expertise with SIEM tools, including Splunk, Sentinel, Elastic, or QRadar, and EDR tools
•Solid understanding of networking, Linux/Windows operating systems, and AWS, Azure, or GCP cloud environments
•Familiarity with common attack techniques and frameworks, including MITRE ATT&CK and the NIST Cybersecurity Framework
•Scripting proficiency in Python, Bash, or PowerShell for automation and tooling
•Background in vulnerability management and remediation workflows
•Strong analytical and problem-solving skills, with the ability to remain calm during incidents
•Clear written and verbal communication skills for documentation and cross-team collaboration
•English proficiency at B2 level
Nice to have:
•Experience with SOAR platforms such as Palo Alto XSOAR or Tines
•Security certifications such as Security+, GCIH, GCIA, CISSP, or OSCP
•Background in threat intelligence or purple/red team collaboration
•Familiarity with container/Kubernetes security
•Experience in a regulated finance industry
Условия
Remote work is available from Ukraine.
