• Responsible for the tools, configuration, administration and related processes around Security Information and Event Management. • Responsible for Web application firewall and related prevention, detection and mitigation of DDoS attack. • Performs regular firewall audits in line with our procedures and provides the appropriate documentation. • Responsible for tooling, processes and follow up actions related to vulnerability scanning. • Handles the identification, planning and implementation of cloud hardening needs. • Performs security incident analysis, response and remediation. • Participates in design and implementation of security automation workflows. • Maintain the technical documentation of processes and procedures. • Perform scripting duties in Bash and Python. • Maintain an advanced level of knowledge of JAMF Cloud Services and related products.

• Identify, assess and mitigate cyber risks and vulnerabilities, ensuring protection of the company’s assets • Manage the SIEM platform by creating, tuning and improving correlation rules and use cases, and defining severity and criticality levels for prioritization and response • Ingest new data sources into the SIEM, including maintenance, normalization/parsing of logs and integrations with internal and external systems • Perform and oversee continuous monitoring of security events and incidents using SIEM, SOAR, EDR/XDR and related solutions • Conduct threat hunting activities to proactively identify suspicious behavior and threats • Work with Threat Intelligence (production and consumption of CTI), integrate with TIPs (such as MISP), and automate IOCs • Lead investigations and incident response efforts for cyber incidents, proposing corrective and preventive actions • Create and review operational documentation and incident response playbooks/flows • Support and follow up on security tests (penetration tests) and track remediation plans • Ensure compliance with standards and regulations (PCI-DSS, ISO 27001, SOC 2, Central Bank regulations), supporting internal and external audits • Produce technical and management reports on security status and incidents handled, recommending continuous improvements • Support and participate in incident simulation exercises: tabletop, red team, blue team and purple team • Drive continuous improvement of SOC processes, workflows and maturity • Collaborate with internal teams on the ongoing evolution of information security practices • Mentor and train team members, promoting information security best practices

• Walk us through your end-to-end process for evaluating security software. • Detail the specific steps and stakeholders involved in a recent SIEM or SecOps purchase. • Describe the challenges you face when comparing different security vendors. • Provide feedback on what makes a vendor evaluation successful for your organization.

• Monitor and respond to security alerts from Microsoft Sentinel, Microsoft Defender XDR, ZeroFox, and Entra ID related activity • Perform initial triage of alerts to determine severity, scope, and whether activity is malicious or a false positive • Conduct basic investigations using available telemetry from Azure, Endpoint, Office, etc • Utilize Kusto Query Language (KQL) to query logs and validate suspicious activity when required • Escalate validated or high-risk alerts to Tier 2 analysts with clear documentation, supporting evidence, and timelines • Follow established SOC playbooks and SOP during alert handling and investigations • Document all investigations and actions taken in the case management system (ServiceNow) with accuracy and clarity • Track and identify recurring alerts or patterns in the environment and report findings to support detection tuning efforts • Support incident response efforts by collecting relevant artifacts and assisting Tier 2 in identifying potential root cause • Provide feedback on SOC processes, playbooks, and workflows to improve operational efficiency • Assist with projects and ongoing efforts to create documentation, support automation initiatives, and review legacy SOC processes • Ensure timely response and adherence to SLAs for alert acknowledgment, triage, and escalation • Assist Compliance teams with audit requests by retrieving and organizing relevant security log data from Sentinel