Cyber Defense Engineer

BeyondTrust is a cybersecurity SaaS company and global leader in privileged access management. The Cyber Defense Engineer will protect enterprise infrastructure and customer-facing products by monitoring, investigating, and responding to security events, while contributing to detection engineering, threat intelligence, AI integration, automation, and operational excellence.

Responsibilities:

• Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments
• Investigate alerts to determine scope, severity, and whether escalation is warranted
• Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect
• Classify, document, and track alerts through the full lifecycle using ticketing and case management systems
• Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication
• Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructure
• Execute established IR runbooks across identity, endpoint, cloud, and email investigation workflows
• Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures
• Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences
• Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps
• Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors
• Help maintain and evolve detection coverage mapped to MITRE ATT&CK
• Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts
• Use AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations
• Contribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows
• Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort
• Partner with engineering teams to improve log ingestion, data quality, and tool integrations
• Maintain daily operational notes and shift handoff documentation
• Contribute to and refine IR runbooks, playbooks, and standard operating procedures
• Participate in on-call rotation for after-hours incident escalation
• Track and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunities
• Participate in tabletop exercises, purple team activities, and post-incident reviews

Requirements:

• 4+ years of experience in a SOC, security operations, or incident response role
• Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior
• Experience with at least one SIEM platform and familiarity with writing search or detection queries
• Familiarity with EDR platforms and cloud environments (IaaS preferred)
• Comfort using AI systems (e.g., LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflows
• Strong written communication skills; able to document findings clearly and concisely for both technical and non-technical audiences
• Experience leading or co-leading complex incident response engagements from triage through remediation
• Experience with identity and access management platforms and cloud security posture management tools
• Scripting and automation skills (Python, PowerShell, or equivalent) applied to security workflows
• Familiarity with SOAR platforms or orchestration tools for automated response and enrichment
• Experience designing or implementing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases
• Experience building or contributing to threat intelligence programs or detection-as-code pipelines
• Understanding of the privileged access management landscape and the threat actors that target it
• Track record of evaluating and adopting emerging technologies in a production security environment