Role Description Security Engineers support the organization’s cybersecurity posture by monitoring security alerts, investigating potential threats, and assisting in the maintenance and improvement of security tools and processes. This role blends traditional Security Operations Center (SOC) responsibilities with foundational security engineering tasks—ideal for early-career professionals with hands-on technical experience who want to grow into more advanced cyber roles. We’re seeking a hands-on Security Operations Engineer who thrives in a 24x7 environment and can detect, analyze, and respond to cyber threats in real time. This role’s primary focus is SOC monitoring and incident response; the secondary focus includes security engineering work to mature detections, tune tooling, automate workflows, and harden the environment. Essential Duties and Responsibilities - Monitor SIEM/XDR/SOAR and other telemetry for alerts, anomalies, and indicators of compromise (IOCs). - Perform Level 1–2 triage, enrichment, scoping, and prioritization of events. - Execute response playbooks (isolation, containment, account/device quarantine, EDR actions, network blocks). - Support incident investigations (forensics acquisition, timeline analysis, root cause). - Document incidents thoroughly (IR tickets, evidence handling, post-incident reports). - Maintain shift logs, knowledge base updates, runbooks, and handoffs. Supervisory Responsibilities This job has no supervisory responsibilities. Qualifications - 2+ years relevant work experience. - Or an equivalent combination of experience and education. - Clear written and verbal communication, decision-making under pressure, and strong collaboration across IT and business teams. - Ability to work independently on shift and drive incidents to closure. Preferred Qualifications - Certifications: GCIA, CySA+ (or equivalent experience). - Experience with SentinelOne, Zscaler ZIA, Google Secops, Azure/M365 security tooling, E-mail security and PAM. Competencies - Detection & Response: Rapid triage, scoping, and containment with minimal escalation. - Analytical Rigor: Able to transform raw telemetry into actionable insights. - Engineering Mindset: Build/tune detections, automate repetitive work, and improve data quality. - Risk Orientation: Prioritize actions based on business impact and threat likelihood. - Documentation: Clear tickets, IR timelines, and post-incident reporting. BFS Competencies - Business and Financial Acumen - Demonstrates functional and/or technical expertise. - Demonstrates problem solving skills. - Results Driven - Holds self and others accountable. - Communicates and sets clear goals with plans to deliver. - Manages competing priorities effectively. - Demonstrates appropriate urgency. - Drives to exceed expectations in alignment with our BFS SPICE values. - Embraces and follows best practices. - Demonstrates self-starter, can-do attitude. Work Environment / Physical Activity The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. - Subject to both typical office environment and outside locations with temperature and weather variations. - Must be able to lift and carry up to 25 pounds. - Occasional travel may be required. Benefits - Medical, dental, vision, and disability insurance plans. - 401(k) retirement savings plan. - PTO (including paid sick time). - 8 paid holidays per year (for salaried and hourly team members).

• Oversee day-to-day operations of a multilocation, global 24/7 SOC monitoring ~3 million endpoints • Recruit, mentor, and train SOC analysts and team leads • Identify and implement automation opportunities to reduce manual workload • Actively assist with and lead threat hunting initiatives • Evaluate and recommend enhancements to SOC tools, technologies, processes, and workflows • Serve as a key point of contact for customer escalations • Manage shift coverage, compliance reporting, and cross-functional collaboration

• Monitor security events and incident logs from various sources, including network devices, servers, endpoints, and security tools. • Identify and analyze potential security incidents and anomalies, taking appropriate actions to investigate and escalate as required. • Participate in incident response activities, including containment, eradication, and recovery procedures. • Work closely with incident response teams and IT staff to mitigate the impact of security incidents and minimize the risk of recurrence. • Stay updated with the latest cybersecurity threats and attack vectors. • Analyze threat intelligence reports to proactively detect and respond to emerging threats. • Operate and maintain security tools, such as SIEM (Security Information and Event Management), IDS/IPS (Intrusion Detection/Prevention Systems), antivirus, and other security-related solutions. • Conduct in-depth analysis of security incidents, perform digital forensics, and document findings for future reference and improvement. • Prepare and submit detailed incident reports, including root cause analysis and recommended remediation actions, to senior management and stakeholders. • Implement continuous monitoring processes to ensure ongoing visibility into the security posture of the organization. • Perform regular audits of security controls and configurations. • Collaborate with the security awareness team to provide input into security training materials and awareness campaigns for employees, enhancing the overall security culture. • Ensure compliance with established security policies, standards, and procedures. • Assist in the development and maintenance of security policies as necessary. • Provide clear and concise shift handover reports to SOC colleagues, ensuring accurate communication of ongoing incidents and pertinent information.

• Driving the design and implementation of defense-in-depth infrastructure and application security solutions for our customer facing SaaS platform in AWS public cloud environments • Driving architecture, implementation, configuration and automation of native and third party cloud security solutions for hardening, detection, prevention, logging and response solutions for security vulnerabilities and threats • Provide thought leadership with a security bent of mind to the organization • Working closely with Product, Engineering and IT in a DevSecOps model on technologies like FWs, ACLs, WAFs, IAM roles and permissions, Vulnerability management and hardening, Threat and Intrusion detection, Kubernetes Container Security solutions, Pen Test and endpoint security • Assisting in incident response and triaging activities as needed for security incidents and events • Using AI in security operations to streamline and optimize the security incident management, resolution.