• Own and maintain key elements of the corporate security program, including identity governance, security policy, and security posture reviews. • Conduct access reviews and support least-privilege access management across corporate systems and SaaS applications. • Manage and maintain endpoint security standards and device security baselines. • Coordinate with third-party security service providers regarding detections, investigations, and response activities. • Develop, maintain, and communicate corporate security policies, standards, and acceptable use requirements. • Serve as a security resource for corporate employees seeking guidance on cybersecurity matters. • Support security awareness initiatives and employee education efforts. • Conduct periodic reviews of SaaS applications, cloud environments, and overall corporate security posture. • Support vendor security reviews and assessments. • Track and report security metrics, risks, and program status to leadership. • Assist in developing governance standards and acceptable use requirements for AI tools. • Evaluate security, privacy, and compliance considerations associated with emerging AI platforms. • Maintain working knowledge of cloud security principles across AWS, Microsoft Azure, and Google Cloud Platform (GCP).

• Monitor security events in real time using SIEM, XDR, and other industry-standard security tools. • Perform advanced alert triage, distinguishing false positives from real incidents. • Correlate events from multiple sources (network, endpoint, identity, cloud). • Execute operational playbooks for initial response. • Escalate relevant incidents to higher tiers (N2) with structured context. • Contribute to rule tuning and continuous improvement of detection quality. • Document evidence, analyses, and classifications in incident management tools.

• Conduct end-to-end technical investigations of security incidents. • Execute response actions (containment, eradication, and recovery). • Perform forensic analysis on endpoints and network events (intermediate/advanced level). • Develop and refine incident response playbooks. • Conduct proactive threat hunting based on hypotheses and threat intelligence. • Prepare technical and executive incident reports. • Collaborate with infrastructure, cloud, and identity teams. • Develop and execute threat hunting strategies based on TTPs. • Create and optimize use cases and detection rules. • Integrate and analyze threat intelligence feeds. • Support complex investigations and critical incidents. • Develop dashboards, advanced queries, and behavioral analyses. • Participate in Red/Purple Team exercises. • Support the technological evolution of the SOC.

• Elaborar diagramas técnicos, documentos de arquitetura e modelos de ameaça • Analisar arquiteturas de sistemas, aplicações e integrações sob a ótica de segurança • Realizar análises de risco técnico e recomendar controles de segurança • Atuar no desenho de soluções seguras para cloud, aplicações e infraestrutura • Apoiar times de desenvolvimento, infraestrutura e DevOps na implementação de controles • Avaliar configurações de segurança (hardening, baseline, CIS Benchmarks) • Apoiar processos de auditoria, compliance e gestão de vulnerabilidades • Efetuar modelagem de ameaças, análise de risco e sugestões de sistemas internos e fornecedores • Conhecimento avançado em OWASP Top 10, CWE, NIST e padrões de segurança • Conhecimento em code reviews com foco em segurança para apoiar times de desenvolvimento na correção de vulnerabilidades • Desenvolver scripts e automações para análise e mitigação de vulnerabilidades